47
Department of the Treasury Internal Revenue Service Records Management Inspection Report National Archives and Records Administration June 30, 2015

Department of the Treasury Internal Revenue Service

Embed Size (px)

Citation preview

Page 1: Department of the Treasury Internal Revenue Service

Department of the Treasury Internal Revenue Service

Records Management Inspection Report

National Archives and Records Administration June 30 2015

Page intentionally left blank

EXECUTIVE SUMMARY

Congress through the Consolidated and Further Continuing Appropriations Act of 2015 directed the Archivist of the United States to conduct an inspection of the Internal Revenue Servicersquos (IRS) compliance with the provisions of Chapters 29 31 and 33 of Title 44 United States Code (USC) during calendar years 2009 through 2013 The Act required that the National Archives and Records Administration (NARA) complete the inspection and report to the appropriate Congressional committees within 180 days of enactment

As a result NARA inspected the Records and Information Management (RIM) Program of the IRS in 2015 NARA conducted this effort under the authority granted it by 44 USC 2904(c)(7) and 2906 to inspect records management programs and practices of federal agencies

In addition to the parameters specified by Congress the purpose of this inspection was to examine the IRS RIM Program with particular interest in the policies and procedures pertaining to the management of email electronic records records scheduling and implementation and the identification risk assessment and transfer of permanent records Therefore there was a focus on the current records management processes and future initiatives

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

There are also challenges to the effectiveness of the IRS RIM Program Therefore this report makes eight findings and nine recommendations The main concerns covered in this report include

The IRS needs to manage all agency email in an electronic records management system that ensures reliability authenticity integrity and usability of email records

The IRSrsquos RIM staff should be included in procedures for notification of loss or potential loss of records and cyber-security incident reporting system to increase their awareness of the risks to records and to comply with 36 CFR 123010

Page i

Executive Summary

The IRS RIM staff should develop and implement mandatory records management training for all staff including senior executives and contractors to ensure agency-wide understanding of their roles and responsibilities under the law

The IRS should continue to upgrade its information technology infrastructure in order to electronically manage email and other electronic records per records management regulations

A complete list of findings and recommendations is included as Appendix C The IRS has provided a memorandum in response to this inspection that is included as Appendix G

The IRS will be required to develop a Plan of Corrective Action (PoCA) to ensure resolution of the recommendations The PoCA should specify how the IRS will address each recommendation and include a timeline for completion of corrective action(s) NARA will analyze the proposed remedial actions and work with the IRS to ensure the adequacy of the PoCA

Page ii

INTRODUCTION 1

BRIEF AGENCY DESCRIPTION 1

INSPECTION OBJECTIVE 2

SCOPE AND PURPOSE 2

FINDINGS AND RECOMMENDATIONS 4

STATUTES AND REGULATIONS 4

IRS RECORDS AND INFORMATION MANAGEMENT (RIM) PROGRAM 5

ONGOING IMPROVEMENT PROJECTS 13

CONCLUSION 17

APPENDICES

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS APPENDIX C COMPLETE LIST OF FINDINGS AND RECOMMENDATIONS APPENDIX D OFFICES VISITED DURING INSPECTION APPENDIX E SELECTED COMPLIANCE QUESTIONS APPENDIX F ACRONYMS AND ABBREVIATIONS APPENDIX G IRSrsquoS MEMORANDUM OF RESPONSE TO NARA

TABLE OF CONTENTS

DEPARTMENT OF THE TREASURY

INTERNAL REVENUE SERVICE

RECORDS MANAGEMENT INSPECTION REPORT

INTRODUCTION

The National Archives and Records Administration (NARA) is responsible for assisting federal agencies in the proper management of records in all media to protect rights assure government accountability and to preserve records of enduring value

In this capacity NARA inspects the records and information management programs of agencies to ensure compliance with federal laws and statutes and to investigate specific issues or concerns Then NARA works with agencies to make improvements to their programs based on inspection findings and recommendations NARA also identifies best practices that could help other agencies

Congress through the Consolidated and Further Continuing Appropriations Act of 2015 directed the Archivist of the United States to conduct an inspection of the Internal Revenue Servicersquos (IRS) compliance with the provisions of Chapters 29 31 and 33 of Title 44 United States Code (USC) during calendar years 2009 through 2013 The Act required that NARA complete the inspection and report to the appropriate Congressional committees within 180 days of enactment In carrying out this responsibility and based on the authority granted to our agency in 44 USC 2904(c)(7) and 2906 NARA conducted an inspection of the Records and Information Management (RIM) Program of the IRS

BRIEF AGENCY DESCRIPTION

The 16th Amendment to the US Constitution established an income tax In the 1950s the agencyrsquos name was changed from the Bureau of Internal Revenue to its current name the Internal Revenue Service The IRS is a bureau of the Department of the Treasury Its mission is to provide American taxpayers top quality services by helping them understand and meet their tax responsibilities and to enforce the law with integrity and fairness to all1

Tax collection is governed by Title 26 of the US Code Internal Revenue Code Handling of taxpayer information and records are covered by Title 26 of the Code of Federal Regulations (CFR) Subtitle F Procedures and Administration Confidentiality non-disclosure and other protection of taxpayer information are specifically covered under 26 CFR 6103

1 httpwwwirsgov

Page 1

The IRS is organized to carry out the responsibilities of the Secretary of the Treasury under section 7801 of the Internal Revenue Code Section 7803 of the Internal Revenue Code provides for the appointment of a Commissioner of Internal Revenue to administer and supervise the execution and application of the internal revenue laws The IRS is divided into three Commissioner-level organizations

Commissioner Internal Revenue - Specialized IRS units report directly to the Commissioners Office The IRS Chief Counsel also reports to the Treasury General Counsel on certain matters

Deputy Commissioner for Services and Enforcement - The Deputy Commissioner reports directly to the Commissioner and oversees the four primary operating divisions and other service and enforcement functions

Deputy Commissioner for Operations Support - The Deputy Commissioner reports directly to the Commissioner and oversees the integrated IRS support functions facilitating economy of scale efficiencies and better business practices

In addition to collecting revenue the IRS examines individual and corporate returns conducts criminal investigations related to potential violations of the tax code and handles tax appeals

INSPECTION OBJECTIVE

This inspection was initiated to determine if the RIM Program of the IRS was in compliance with Chapters 29 31 and 33 of Title 44 United States Code between the years 2009 and 2013

In keeping with NARArsquos standard records and information management inspection objectives NARA also sought to determine if the current IRS RIM Program has policies and procedures to ensure records regardless of format are created captured maintained and disposed of in accordance with the records management regulations located at 36 CFR Chapter XII There was particular emphasis on email management other electronic records management records scheduling and implementation and the identification risk assessment and transfer of permanent records

SCOPE AND PURPOSE

This is a comprehensive inspection of the IRS RIM Program

Examining implementation of records management policies standards procedures retention schedules and other tactics

Examining training of staff on their RM roles and responsibilities Emphasizing the importance of electronic records management

Page 2

METHODOLOGY

This inspection was conducted using a combination of site visits teleconferences and a review of received documentation

The inspection team used a detailed checklist based on federal statutes regulations and NARA guidance For a complete checklist see Appendix E

The inspection team reviewed the IRSrsquos responses to the annual Records Management Self-Assessment (RMSA) from 2009 through 2014 and the Senior Agency Official (SAO) for Records Management Annual Report from the Department of the Treasury 2013 and 2014

The IRS provided documentation of records management policies procedures training curriculum metrics covering training and performance goals and measures covering 2009 through current For a summarized list of documents see Appendix A

There were five site visits consisting of meetings with multiple offices During the site visits the NARA inspection team met with the IRSrsquos RIM staff a small sample of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) information technology staff and representatives from the Department of the Treasury Office of Privacy Records and Transparency For a complete list of site visits see Appendix D

There were multiple teleconferences with the IRSrsquos RIM staff

STRUCTURE OF THE REPORT

In accordance with 36 CFR 1239 this report contains

(1) An executive summary (2) Background and purpose of inspection (3) Inspection methodology including offices visited (4) Findings (5) Corrective actions needed and other recommendations and (6) Any necessary appendices such as summaries of each site visit or the inspection instrument

The IRS has provided a memorandum in response to this inspection (See Appendix G)

Page 3

FINDINGS AND RECOMMENDATIONS

Using the parameters established by Congress we examined the IRSrsquos compliance with records management regulations from 2009 through 2013 The inspection also included analysis of current records management processes and future initiatives

NARA makes eight findings and nine recommendations to assist the IRS with its records management program

STATUTES AND REGULATIONS

36 CFR Chapter XII Subchapter B specifies policies for federal agenciesrsquo records management programs relating to proper records creation and maintenance adequate documentation and records disposition The regulations in this Subchapter implement the provisions of 44 USC Chapters 21 29 31 and 33

The Federal Records Act requirements for federal agencies are found in 44 USC Chapter 31 Records Management by Federal Agencies At a high level agency heads are responsible for ensuring several things including

The adequate and proper documentation of agency activities (44 USC 3101)

A program of management to ensure effective controls over the creation maintenance and use of records in the conduct of their current business (44 USC 3102(1))

Compliance with NARA guidance and regulations and compliance with other sections of the Federal Records Act that give NARA authority to promulgate guidance regulations and records disposition authority to federal agencies (44 USC 3102(2) and (3))

The regulations implementing the Federal Records Act are found in 36 CFR Chapter XII Subchapter BmdashRecords Management NARA provides additional guidance to agencies at its records management website - httpwwwarchivesgovrecords-mgmt

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 The IRS RIM Program satisfied the objectives of the relevant regulations which according to 36 CFR 122034 require all agencies to

(a) Assign records management responsibility to a person and office with appropriate authority within the agency to coordinate and oversee implementation of the agency comprehensive records management program principles in sect122032

(b) Advise NARA and agency managers of the name(s) of the individual(s) assigned operational responsibility for the agency records management program

(c) Issue a directive(s) establishing program objectives responsibilities and authorities for the creation maintenance and disposition of agency records

Page 4

(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance storage and disposition practices into agency programs processes systems and procedures

(e) Integrate records management and archival requirements into the design development and implementation of electronic information systems as specified in sect123612

(f) Provide guidance and training to all agency personnel on their records management responsibilities including identification of federal records in all formats and media

(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation in accordance with sect1225 and sect1226 of this Subchapter

(h) Comply with applicable policies procedures and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget and NARA or other agencies as appropriate

(i) Institute controls ensuring that all records regardless of format or medium are properly organized classified or indexed and described and made available for use by all appropriate agency staff and

(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations in this Subchapter2

The IRS RIM Programrsquos policies and procedures meet the elements of the regulations although this inspection identified some conditions that add risk to the program Those conditions are described in the following section

THE IRS RECORDS AND INFORMATION MANAGEMENT PROGRAM

The IRS has a small headquarters-based RIM staff of six people There is a nationwide system of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) charged with a combination of information dissemination and physical responsibilities for the management of records for each business unit There are 14 ARMs and approximately 3000 IRCs This complies with 36 CFR 122034(d) which requires that records management responsibilities be assigned to a network of records liaison officers in program and field offices

2 36 CFR 122034 httpwwwecfrgov

Page 5

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 2: Department of the Treasury Internal Revenue Service

Page intentionally left blank

EXECUTIVE SUMMARY

Congress through the Consolidated and Further Continuing Appropriations Act of 2015 directed the Archivist of the United States to conduct an inspection of the Internal Revenue Servicersquos (IRS) compliance with the provisions of Chapters 29 31 and 33 of Title 44 United States Code (USC) during calendar years 2009 through 2013 The Act required that the National Archives and Records Administration (NARA) complete the inspection and report to the appropriate Congressional committees within 180 days of enactment

As a result NARA inspected the Records and Information Management (RIM) Program of the IRS in 2015 NARA conducted this effort under the authority granted it by 44 USC 2904(c)(7) and 2906 to inspect records management programs and practices of federal agencies

In addition to the parameters specified by Congress the purpose of this inspection was to examine the IRS RIM Program with particular interest in the policies and procedures pertaining to the management of email electronic records records scheduling and implementation and the identification risk assessment and transfer of permanent records Therefore there was a focus on the current records management processes and future initiatives

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

There are also challenges to the effectiveness of the IRS RIM Program Therefore this report makes eight findings and nine recommendations The main concerns covered in this report include

The IRS needs to manage all agency email in an electronic records management system that ensures reliability authenticity integrity and usability of email records

The IRSrsquos RIM staff should be included in procedures for notification of loss or potential loss of records and cyber-security incident reporting system to increase their awareness of the risks to records and to comply with 36 CFR 123010

Page i

Executive Summary

The IRS RIM staff should develop and implement mandatory records management training for all staff including senior executives and contractors to ensure agency-wide understanding of their roles and responsibilities under the law

The IRS should continue to upgrade its information technology infrastructure in order to electronically manage email and other electronic records per records management regulations

A complete list of findings and recommendations is included as Appendix C The IRS has provided a memorandum in response to this inspection that is included as Appendix G

The IRS will be required to develop a Plan of Corrective Action (PoCA) to ensure resolution of the recommendations The PoCA should specify how the IRS will address each recommendation and include a timeline for completion of corrective action(s) NARA will analyze the proposed remedial actions and work with the IRS to ensure the adequacy of the PoCA

Page ii

INTRODUCTION 1

BRIEF AGENCY DESCRIPTION 1

INSPECTION OBJECTIVE 2

SCOPE AND PURPOSE 2

FINDINGS AND RECOMMENDATIONS 4

STATUTES AND REGULATIONS 4

IRS RECORDS AND INFORMATION MANAGEMENT (RIM) PROGRAM 5

ONGOING IMPROVEMENT PROJECTS 13

CONCLUSION 17

APPENDICES

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS APPENDIX C COMPLETE LIST OF FINDINGS AND RECOMMENDATIONS APPENDIX D OFFICES VISITED DURING INSPECTION APPENDIX E SELECTED COMPLIANCE QUESTIONS APPENDIX F ACRONYMS AND ABBREVIATIONS APPENDIX G IRSrsquoS MEMORANDUM OF RESPONSE TO NARA

TABLE OF CONTENTS

DEPARTMENT OF THE TREASURY

INTERNAL REVENUE SERVICE

RECORDS MANAGEMENT INSPECTION REPORT

INTRODUCTION

The National Archives and Records Administration (NARA) is responsible for assisting federal agencies in the proper management of records in all media to protect rights assure government accountability and to preserve records of enduring value

In this capacity NARA inspects the records and information management programs of agencies to ensure compliance with federal laws and statutes and to investigate specific issues or concerns Then NARA works with agencies to make improvements to their programs based on inspection findings and recommendations NARA also identifies best practices that could help other agencies

Congress through the Consolidated and Further Continuing Appropriations Act of 2015 directed the Archivist of the United States to conduct an inspection of the Internal Revenue Servicersquos (IRS) compliance with the provisions of Chapters 29 31 and 33 of Title 44 United States Code (USC) during calendar years 2009 through 2013 The Act required that NARA complete the inspection and report to the appropriate Congressional committees within 180 days of enactment In carrying out this responsibility and based on the authority granted to our agency in 44 USC 2904(c)(7) and 2906 NARA conducted an inspection of the Records and Information Management (RIM) Program of the IRS

BRIEF AGENCY DESCRIPTION

The 16th Amendment to the US Constitution established an income tax In the 1950s the agencyrsquos name was changed from the Bureau of Internal Revenue to its current name the Internal Revenue Service The IRS is a bureau of the Department of the Treasury Its mission is to provide American taxpayers top quality services by helping them understand and meet their tax responsibilities and to enforce the law with integrity and fairness to all1

Tax collection is governed by Title 26 of the US Code Internal Revenue Code Handling of taxpayer information and records are covered by Title 26 of the Code of Federal Regulations (CFR) Subtitle F Procedures and Administration Confidentiality non-disclosure and other protection of taxpayer information are specifically covered under 26 CFR 6103

1 httpwwwirsgov

Page 1

The IRS is organized to carry out the responsibilities of the Secretary of the Treasury under section 7801 of the Internal Revenue Code Section 7803 of the Internal Revenue Code provides for the appointment of a Commissioner of Internal Revenue to administer and supervise the execution and application of the internal revenue laws The IRS is divided into three Commissioner-level organizations

Commissioner Internal Revenue - Specialized IRS units report directly to the Commissioners Office The IRS Chief Counsel also reports to the Treasury General Counsel on certain matters

Deputy Commissioner for Services and Enforcement - The Deputy Commissioner reports directly to the Commissioner and oversees the four primary operating divisions and other service and enforcement functions

Deputy Commissioner for Operations Support - The Deputy Commissioner reports directly to the Commissioner and oversees the integrated IRS support functions facilitating economy of scale efficiencies and better business practices

In addition to collecting revenue the IRS examines individual and corporate returns conducts criminal investigations related to potential violations of the tax code and handles tax appeals

INSPECTION OBJECTIVE

This inspection was initiated to determine if the RIM Program of the IRS was in compliance with Chapters 29 31 and 33 of Title 44 United States Code between the years 2009 and 2013

In keeping with NARArsquos standard records and information management inspection objectives NARA also sought to determine if the current IRS RIM Program has policies and procedures to ensure records regardless of format are created captured maintained and disposed of in accordance with the records management regulations located at 36 CFR Chapter XII There was particular emphasis on email management other electronic records management records scheduling and implementation and the identification risk assessment and transfer of permanent records

SCOPE AND PURPOSE

This is a comprehensive inspection of the IRS RIM Program

Examining implementation of records management policies standards procedures retention schedules and other tactics

Examining training of staff on their RM roles and responsibilities Emphasizing the importance of electronic records management

Page 2

METHODOLOGY

This inspection was conducted using a combination of site visits teleconferences and a review of received documentation

The inspection team used a detailed checklist based on federal statutes regulations and NARA guidance For a complete checklist see Appendix E

The inspection team reviewed the IRSrsquos responses to the annual Records Management Self-Assessment (RMSA) from 2009 through 2014 and the Senior Agency Official (SAO) for Records Management Annual Report from the Department of the Treasury 2013 and 2014

The IRS provided documentation of records management policies procedures training curriculum metrics covering training and performance goals and measures covering 2009 through current For a summarized list of documents see Appendix A

There were five site visits consisting of meetings with multiple offices During the site visits the NARA inspection team met with the IRSrsquos RIM staff a small sample of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) information technology staff and representatives from the Department of the Treasury Office of Privacy Records and Transparency For a complete list of site visits see Appendix D

There were multiple teleconferences with the IRSrsquos RIM staff

STRUCTURE OF THE REPORT

In accordance with 36 CFR 1239 this report contains

(1) An executive summary (2) Background and purpose of inspection (3) Inspection methodology including offices visited (4) Findings (5) Corrective actions needed and other recommendations and (6) Any necessary appendices such as summaries of each site visit or the inspection instrument

The IRS has provided a memorandum in response to this inspection (See Appendix G)

Page 3

FINDINGS AND RECOMMENDATIONS

Using the parameters established by Congress we examined the IRSrsquos compliance with records management regulations from 2009 through 2013 The inspection also included analysis of current records management processes and future initiatives

NARA makes eight findings and nine recommendations to assist the IRS with its records management program

STATUTES AND REGULATIONS

36 CFR Chapter XII Subchapter B specifies policies for federal agenciesrsquo records management programs relating to proper records creation and maintenance adequate documentation and records disposition The regulations in this Subchapter implement the provisions of 44 USC Chapters 21 29 31 and 33

The Federal Records Act requirements for federal agencies are found in 44 USC Chapter 31 Records Management by Federal Agencies At a high level agency heads are responsible for ensuring several things including

The adequate and proper documentation of agency activities (44 USC 3101)

A program of management to ensure effective controls over the creation maintenance and use of records in the conduct of their current business (44 USC 3102(1))

Compliance with NARA guidance and regulations and compliance with other sections of the Federal Records Act that give NARA authority to promulgate guidance regulations and records disposition authority to federal agencies (44 USC 3102(2) and (3))

The regulations implementing the Federal Records Act are found in 36 CFR Chapter XII Subchapter BmdashRecords Management NARA provides additional guidance to agencies at its records management website - httpwwwarchivesgovrecords-mgmt

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 The IRS RIM Program satisfied the objectives of the relevant regulations which according to 36 CFR 122034 require all agencies to

(a) Assign records management responsibility to a person and office with appropriate authority within the agency to coordinate and oversee implementation of the agency comprehensive records management program principles in sect122032

(b) Advise NARA and agency managers of the name(s) of the individual(s) assigned operational responsibility for the agency records management program

(c) Issue a directive(s) establishing program objectives responsibilities and authorities for the creation maintenance and disposition of agency records

Page 4

(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance storage and disposition practices into agency programs processes systems and procedures

(e) Integrate records management and archival requirements into the design development and implementation of electronic information systems as specified in sect123612

(f) Provide guidance and training to all agency personnel on their records management responsibilities including identification of federal records in all formats and media

(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation in accordance with sect1225 and sect1226 of this Subchapter

(h) Comply with applicable policies procedures and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget and NARA or other agencies as appropriate

(i) Institute controls ensuring that all records regardless of format or medium are properly organized classified or indexed and described and made available for use by all appropriate agency staff and

(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations in this Subchapter2

The IRS RIM Programrsquos policies and procedures meet the elements of the regulations although this inspection identified some conditions that add risk to the program Those conditions are described in the following section

THE IRS RECORDS AND INFORMATION MANAGEMENT PROGRAM

The IRS has a small headquarters-based RIM staff of six people There is a nationwide system of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) charged with a combination of information dissemination and physical responsibilities for the management of records for each business unit There are 14 ARMs and approximately 3000 IRCs This complies with 36 CFR 122034(d) which requires that records management responsibilities be assigned to a network of records liaison officers in program and field offices

2 36 CFR 122034 httpwwwecfrgov

Page 5

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 3: Department of the Treasury Internal Revenue Service

EXECUTIVE SUMMARY

Congress through the Consolidated and Further Continuing Appropriations Act of 2015 directed the Archivist of the United States to conduct an inspection of the Internal Revenue Servicersquos (IRS) compliance with the provisions of Chapters 29 31 and 33 of Title 44 United States Code (USC) during calendar years 2009 through 2013 The Act required that the National Archives and Records Administration (NARA) complete the inspection and report to the appropriate Congressional committees within 180 days of enactment

As a result NARA inspected the Records and Information Management (RIM) Program of the IRS in 2015 NARA conducted this effort under the authority granted it by 44 USC 2904(c)(7) and 2906 to inspect records management programs and practices of federal agencies

In addition to the parameters specified by Congress the purpose of this inspection was to examine the IRS RIM Program with particular interest in the policies and procedures pertaining to the management of email electronic records records scheduling and implementation and the identification risk assessment and transfer of permanent records Therefore there was a focus on the current records management processes and future initiatives

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

There are also challenges to the effectiveness of the IRS RIM Program Therefore this report makes eight findings and nine recommendations The main concerns covered in this report include

The IRS needs to manage all agency email in an electronic records management system that ensures reliability authenticity integrity and usability of email records

The IRSrsquos RIM staff should be included in procedures for notification of loss or potential loss of records and cyber-security incident reporting system to increase their awareness of the risks to records and to comply with 36 CFR 123010

Page i

Executive Summary

The IRS RIM staff should develop and implement mandatory records management training for all staff including senior executives and contractors to ensure agency-wide understanding of their roles and responsibilities under the law

The IRS should continue to upgrade its information technology infrastructure in order to electronically manage email and other electronic records per records management regulations

A complete list of findings and recommendations is included as Appendix C The IRS has provided a memorandum in response to this inspection that is included as Appendix G

The IRS will be required to develop a Plan of Corrective Action (PoCA) to ensure resolution of the recommendations The PoCA should specify how the IRS will address each recommendation and include a timeline for completion of corrective action(s) NARA will analyze the proposed remedial actions and work with the IRS to ensure the adequacy of the PoCA

Page ii

INTRODUCTION 1

BRIEF AGENCY DESCRIPTION 1

INSPECTION OBJECTIVE 2

SCOPE AND PURPOSE 2

FINDINGS AND RECOMMENDATIONS 4

STATUTES AND REGULATIONS 4

IRS RECORDS AND INFORMATION MANAGEMENT (RIM) PROGRAM 5

ONGOING IMPROVEMENT PROJECTS 13

CONCLUSION 17

APPENDICES

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS APPENDIX C COMPLETE LIST OF FINDINGS AND RECOMMENDATIONS APPENDIX D OFFICES VISITED DURING INSPECTION APPENDIX E SELECTED COMPLIANCE QUESTIONS APPENDIX F ACRONYMS AND ABBREVIATIONS APPENDIX G IRSrsquoS MEMORANDUM OF RESPONSE TO NARA

TABLE OF CONTENTS

DEPARTMENT OF THE TREASURY

INTERNAL REVENUE SERVICE

RECORDS MANAGEMENT INSPECTION REPORT

INTRODUCTION

The National Archives and Records Administration (NARA) is responsible for assisting federal agencies in the proper management of records in all media to protect rights assure government accountability and to preserve records of enduring value

In this capacity NARA inspects the records and information management programs of agencies to ensure compliance with federal laws and statutes and to investigate specific issues or concerns Then NARA works with agencies to make improvements to their programs based on inspection findings and recommendations NARA also identifies best practices that could help other agencies

Congress through the Consolidated and Further Continuing Appropriations Act of 2015 directed the Archivist of the United States to conduct an inspection of the Internal Revenue Servicersquos (IRS) compliance with the provisions of Chapters 29 31 and 33 of Title 44 United States Code (USC) during calendar years 2009 through 2013 The Act required that NARA complete the inspection and report to the appropriate Congressional committees within 180 days of enactment In carrying out this responsibility and based on the authority granted to our agency in 44 USC 2904(c)(7) and 2906 NARA conducted an inspection of the Records and Information Management (RIM) Program of the IRS

BRIEF AGENCY DESCRIPTION

The 16th Amendment to the US Constitution established an income tax In the 1950s the agencyrsquos name was changed from the Bureau of Internal Revenue to its current name the Internal Revenue Service The IRS is a bureau of the Department of the Treasury Its mission is to provide American taxpayers top quality services by helping them understand and meet their tax responsibilities and to enforce the law with integrity and fairness to all1

Tax collection is governed by Title 26 of the US Code Internal Revenue Code Handling of taxpayer information and records are covered by Title 26 of the Code of Federal Regulations (CFR) Subtitle F Procedures and Administration Confidentiality non-disclosure and other protection of taxpayer information are specifically covered under 26 CFR 6103

1 httpwwwirsgov

Page 1

The IRS is organized to carry out the responsibilities of the Secretary of the Treasury under section 7801 of the Internal Revenue Code Section 7803 of the Internal Revenue Code provides for the appointment of a Commissioner of Internal Revenue to administer and supervise the execution and application of the internal revenue laws The IRS is divided into three Commissioner-level organizations

Commissioner Internal Revenue - Specialized IRS units report directly to the Commissioners Office The IRS Chief Counsel also reports to the Treasury General Counsel on certain matters

Deputy Commissioner for Services and Enforcement - The Deputy Commissioner reports directly to the Commissioner and oversees the four primary operating divisions and other service and enforcement functions

Deputy Commissioner for Operations Support - The Deputy Commissioner reports directly to the Commissioner and oversees the integrated IRS support functions facilitating economy of scale efficiencies and better business practices

In addition to collecting revenue the IRS examines individual and corporate returns conducts criminal investigations related to potential violations of the tax code and handles tax appeals

INSPECTION OBJECTIVE

This inspection was initiated to determine if the RIM Program of the IRS was in compliance with Chapters 29 31 and 33 of Title 44 United States Code between the years 2009 and 2013

In keeping with NARArsquos standard records and information management inspection objectives NARA also sought to determine if the current IRS RIM Program has policies and procedures to ensure records regardless of format are created captured maintained and disposed of in accordance with the records management regulations located at 36 CFR Chapter XII There was particular emphasis on email management other electronic records management records scheduling and implementation and the identification risk assessment and transfer of permanent records

SCOPE AND PURPOSE

This is a comprehensive inspection of the IRS RIM Program

Examining implementation of records management policies standards procedures retention schedules and other tactics

Examining training of staff on their RM roles and responsibilities Emphasizing the importance of electronic records management

Page 2

METHODOLOGY

This inspection was conducted using a combination of site visits teleconferences and a review of received documentation

The inspection team used a detailed checklist based on federal statutes regulations and NARA guidance For a complete checklist see Appendix E

The inspection team reviewed the IRSrsquos responses to the annual Records Management Self-Assessment (RMSA) from 2009 through 2014 and the Senior Agency Official (SAO) for Records Management Annual Report from the Department of the Treasury 2013 and 2014

The IRS provided documentation of records management policies procedures training curriculum metrics covering training and performance goals and measures covering 2009 through current For a summarized list of documents see Appendix A

There were five site visits consisting of meetings with multiple offices During the site visits the NARA inspection team met with the IRSrsquos RIM staff a small sample of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) information technology staff and representatives from the Department of the Treasury Office of Privacy Records and Transparency For a complete list of site visits see Appendix D

There were multiple teleconferences with the IRSrsquos RIM staff

STRUCTURE OF THE REPORT

In accordance with 36 CFR 1239 this report contains

(1) An executive summary (2) Background and purpose of inspection (3) Inspection methodology including offices visited (4) Findings (5) Corrective actions needed and other recommendations and (6) Any necessary appendices such as summaries of each site visit or the inspection instrument

The IRS has provided a memorandum in response to this inspection (See Appendix G)

Page 3

FINDINGS AND RECOMMENDATIONS

Using the parameters established by Congress we examined the IRSrsquos compliance with records management regulations from 2009 through 2013 The inspection also included analysis of current records management processes and future initiatives

NARA makes eight findings and nine recommendations to assist the IRS with its records management program

STATUTES AND REGULATIONS

36 CFR Chapter XII Subchapter B specifies policies for federal agenciesrsquo records management programs relating to proper records creation and maintenance adequate documentation and records disposition The regulations in this Subchapter implement the provisions of 44 USC Chapters 21 29 31 and 33

The Federal Records Act requirements for federal agencies are found in 44 USC Chapter 31 Records Management by Federal Agencies At a high level agency heads are responsible for ensuring several things including

The adequate and proper documentation of agency activities (44 USC 3101)

A program of management to ensure effective controls over the creation maintenance and use of records in the conduct of their current business (44 USC 3102(1))

Compliance with NARA guidance and regulations and compliance with other sections of the Federal Records Act that give NARA authority to promulgate guidance regulations and records disposition authority to federal agencies (44 USC 3102(2) and (3))

The regulations implementing the Federal Records Act are found in 36 CFR Chapter XII Subchapter BmdashRecords Management NARA provides additional guidance to agencies at its records management website - httpwwwarchivesgovrecords-mgmt

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 The IRS RIM Program satisfied the objectives of the relevant regulations which according to 36 CFR 122034 require all agencies to

(a) Assign records management responsibility to a person and office with appropriate authority within the agency to coordinate and oversee implementation of the agency comprehensive records management program principles in sect122032

(b) Advise NARA and agency managers of the name(s) of the individual(s) assigned operational responsibility for the agency records management program

(c) Issue a directive(s) establishing program objectives responsibilities and authorities for the creation maintenance and disposition of agency records

Page 4

(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance storage and disposition practices into agency programs processes systems and procedures

(e) Integrate records management and archival requirements into the design development and implementation of electronic information systems as specified in sect123612

(f) Provide guidance and training to all agency personnel on their records management responsibilities including identification of federal records in all formats and media

(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation in accordance with sect1225 and sect1226 of this Subchapter

(h) Comply with applicable policies procedures and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget and NARA or other agencies as appropriate

(i) Institute controls ensuring that all records regardless of format or medium are properly organized classified or indexed and described and made available for use by all appropriate agency staff and

(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations in this Subchapter2

The IRS RIM Programrsquos policies and procedures meet the elements of the regulations although this inspection identified some conditions that add risk to the program Those conditions are described in the following section

THE IRS RECORDS AND INFORMATION MANAGEMENT PROGRAM

The IRS has a small headquarters-based RIM staff of six people There is a nationwide system of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) charged with a combination of information dissemination and physical responsibilities for the management of records for each business unit There are 14 ARMs and approximately 3000 IRCs This complies with 36 CFR 122034(d) which requires that records management responsibilities be assigned to a network of records liaison officers in program and field offices

2 36 CFR 122034 httpwwwecfrgov

Page 5

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 4: Department of the Treasury Internal Revenue Service

Executive Summary

The IRS RIM staff should develop and implement mandatory records management training for all staff including senior executives and contractors to ensure agency-wide understanding of their roles and responsibilities under the law

The IRS should continue to upgrade its information technology infrastructure in order to electronically manage email and other electronic records per records management regulations

A complete list of findings and recommendations is included as Appendix C The IRS has provided a memorandum in response to this inspection that is included as Appendix G

The IRS will be required to develop a Plan of Corrective Action (PoCA) to ensure resolution of the recommendations The PoCA should specify how the IRS will address each recommendation and include a timeline for completion of corrective action(s) NARA will analyze the proposed remedial actions and work with the IRS to ensure the adequacy of the PoCA

Page ii

INTRODUCTION 1

BRIEF AGENCY DESCRIPTION 1

INSPECTION OBJECTIVE 2

SCOPE AND PURPOSE 2

FINDINGS AND RECOMMENDATIONS 4

STATUTES AND REGULATIONS 4

IRS RECORDS AND INFORMATION MANAGEMENT (RIM) PROGRAM 5

ONGOING IMPROVEMENT PROJECTS 13

CONCLUSION 17

APPENDICES

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS APPENDIX C COMPLETE LIST OF FINDINGS AND RECOMMENDATIONS APPENDIX D OFFICES VISITED DURING INSPECTION APPENDIX E SELECTED COMPLIANCE QUESTIONS APPENDIX F ACRONYMS AND ABBREVIATIONS APPENDIX G IRSrsquoS MEMORANDUM OF RESPONSE TO NARA

TABLE OF CONTENTS

DEPARTMENT OF THE TREASURY

INTERNAL REVENUE SERVICE

RECORDS MANAGEMENT INSPECTION REPORT

INTRODUCTION

The National Archives and Records Administration (NARA) is responsible for assisting federal agencies in the proper management of records in all media to protect rights assure government accountability and to preserve records of enduring value

In this capacity NARA inspects the records and information management programs of agencies to ensure compliance with federal laws and statutes and to investigate specific issues or concerns Then NARA works with agencies to make improvements to their programs based on inspection findings and recommendations NARA also identifies best practices that could help other agencies

Congress through the Consolidated and Further Continuing Appropriations Act of 2015 directed the Archivist of the United States to conduct an inspection of the Internal Revenue Servicersquos (IRS) compliance with the provisions of Chapters 29 31 and 33 of Title 44 United States Code (USC) during calendar years 2009 through 2013 The Act required that NARA complete the inspection and report to the appropriate Congressional committees within 180 days of enactment In carrying out this responsibility and based on the authority granted to our agency in 44 USC 2904(c)(7) and 2906 NARA conducted an inspection of the Records and Information Management (RIM) Program of the IRS

BRIEF AGENCY DESCRIPTION

The 16th Amendment to the US Constitution established an income tax In the 1950s the agencyrsquos name was changed from the Bureau of Internal Revenue to its current name the Internal Revenue Service The IRS is a bureau of the Department of the Treasury Its mission is to provide American taxpayers top quality services by helping them understand and meet their tax responsibilities and to enforce the law with integrity and fairness to all1

Tax collection is governed by Title 26 of the US Code Internal Revenue Code Handling of taxpayer information and records are covered by Title 26 of the Code of Federal Regulations (CFR) Subtitle F Procedures and Administration Confidentiality non-disclosure and other protection of taxpayer information are specifically covered under 26 CFR 6103

1 httpwwwirsgov

Page 1

The IRS is organized to carry out the responsibilities of the Secretary of the Treasury under section 7801 of the Internal Revenue Code Section 7803 of the Internal Revenue Code provides for the appointment of a Commissioner of Internal Revenue to administer and supervise the execution and application of the internal revenue laws The IRS is divided into three Commissioner-level organizations

Commissioner Internal Revenue - Specialized IRS units report directly to the Commissioners Office The IRS Chief Counsel also reports to the Treasury General Counsel on certain matters

Deputy Commissioner for Services and Enforcement - The Deputy Commissioner reports directly to the Commissioner and oversees the four primary operating divisions and other service and enforcement functions

Deputy Commissioner for Operations Support - The Deputy Commissioner reports directly to the Commissioner and oversees the integrated IRS support functions facilitating economy of scale efficiencies and better business practices

In addition to collecting revenue the IRS examines individual and corporate returns conducts criminal investigations related to potential violations of the tax code and handles tax appeals

INSPECTION OBJECTIVE

This inspection was initiated to determine if the RIM Program of the IRS was in compliance with Chapters 29 31 and 33 of Title 44 United States Code between the years 2009 and 2013

In keeping with NARArsquos standard records and information management inspection objectives NARA also sought to determine if the current IRS RIM Program has policies and procedures to ensure records regardless of format are created captured maintained and disposed of in accordance with the records management regulations located at 36 CFR Chapter XII There was particular emphasis on email management other electronic records management records scheduling and implementation and the identification risk assessment and transfer of permanent records

SCOPE AND PURPOSE

This is a comprehensive inspection of the IRS RIM Program

Examining implementation of records management policies standards procedures retention schedules and other tactics

Examining training of staff on their RM roles and responsibilities Emphasizing the importance of electronic records management

Page 2

METHODOLOGY

This inspection was conducted using a combination of site visits teleconferences and a review of received documentation

The inspection team used a detailed checklist based on federal statutes regulations and NARA guidance For a complete checklist see Appendix E

The inspection team reviewed the IRSrsquos responses to the annual Records Management Self-Assessment (RMSA) from 2009 through 2014 and the Senior Agency Official (SAO) for Records Management Annual Report from the Department of the Treasury 2013 and 2014

The IRS provided documentation of records management policies procedures training curriculum metrics covering training and performance goals and measures covering 2009 through current For a summarized list of documents see Appendix A

There were five site visits consisting of meetings with multiple offices During the site visits the NARA inspection team met with the IRSrsquos RIM staff a small sample of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) information technology staff and representatives from the Department of the Treasury Office of Privacy Records and Transparency For a complete list of site visits see Appendix D

There were multiple teleconferences with the IRSrsquos RIM staff

STRUCTURE OF THE REPORT

In accordance with 36 CFR 1239 this report contains

(1) An executive summary (2) Background and purpose of inspection (3) Inspection methodology including offices visited (4) Findings (5) Corrective actions needed and other recommendations and (6) Any necessary appendices such as summaries of each site visit or the inspection instrument

The IRS has provided a memorandum in response to this inspection (See Appendix G)

Page 3

FINDINGS AND RECOMMENDATIONS

Using the parameters established by Congress we examined the IRSrsquos compliance with records management regulations from 2009 through 2013 The inspection also included analysis of current records management processes and future initiatives

NARA makes eight findings and nine recommendations to assist the IRS with its records management program

STATUTES AND REGULATIONS

36 CFR Chapter XII Subchapter B specifies policies for federal agenciesrsquo records management programs relating to proper records creation and maintenance adequate documentation and records disposition The regulations in this Subchapter implement the provisions of 44 USC Chapters 21 29 31 and 33

The Federal Records Act requirements for federal agencies are found in 44 USC Chapter 31 Records Management by Federal Agencies At a high level agency heads are responsible for ensuring several things including

The adequate and proper documentation of agency activities (44 USC 3101)

A program of management to ensure effective controls over the creation maintenance and use of records in the conduct of their current business (44 USC 3102(1))

Compliance with NARA guidance and regulations and compliance with other sections of the Federal Records Act that give NARA authority to promulgate guidance regulations and records disposition authority to federal agencies (44 USC 3102(2) and (3))

The regulations implementing the Federal Records Act are found in 36 CFR Chapter XII Subchapter BmdashRecords Management NARA provides additional guidance to agencies at its records management website - httpwwwarchivesgovrecords-mgmt

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 The IRS RIM Program satisfied the objectives of the relevant regulations which according to 36 CFR 122034 require all agencies to

(a) Assign records management responsibility to a person and office with appropriate authority within the agency to coordinate and oversee implementation of the agency comprehensive records management program principles in sect122032

(b) Advise NARA and agency managers of the name(s) of the individual(s) assigned operational responsibility for the agency records management program

(c) Issue a directive(s) establishing program objectives responsibilities and authorities for the creation maintenance and disposition of agency records

Page 4

(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance storage and disposition practices into agency programs processes systems and procedures

(e) Integrate records management and archival requirements into the design development and implementation of electronic information systems as specified in sect123612

(f) Provide guidance and training to all agency personnel on their records management responsibilities including identification of federal records in all formats and media

(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation in accordance with sect1225 and sect1226 of this Subchapter

(h) Comply with applicable policies procedures and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget and NARA or other agencies as appropriate

(i) Institute controls ensuring that all records regardless of format or medium are properly organized classified or indexed and described and made available for use by all appropriate agency staff and

(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations in this Subchapter2

The IRS RIM Programrsquos policies and procedures meet the elements of the regulations although this inspection identified some conditions that add risk to the program Those conditions are described in the following section

THE IRS RECORDS AND INFORMATION MANAGEMENT PROGRAM

The IRS has a small headquarters-based RIM staff of six people There is a nationwide system of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) charged with a combination of information dissemination and physical responsibilities for the management of records for each business unit There are 14 ARMs and approximately 3000 IRCs This complies with 36 CFR 122034(d) which requires that records management responsibilities be assigned to a network of records liaison officers in program and field offices

2 36 CFR 122034 httpwwwecfrgov

Page 5

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 5: Department of the Treasury Internal Revenue Service

INTRODUCTION 1

BRIEF AGENCY DESCRIPTION 1

INSPECTION OBJECTIVE 2

SCOPE AND PURPOSE 2

FINDINGS AND RECOMMENDATIONS 4

STATUTES AND REGULATIONS 4

IRS RECORDS AND INFORMATION MANAGEMENT (RIM) PROGRAM 5

ONGOING IMPROVEMENT PROJECTS 13

CONCLUSION 17

APPENDICES

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS APPENDIX C COMPLETE LIST OF FINDINGS AND RECOMMENDATIONS APPENDIX D OFFICES VISITED DURING INSPECTION APPENDIX E SELECTED COMPLIANCE QUESTIONS APPENDIX F ACRONYMS AND ABBREVIATIONS APPENDIX G IRSrsquoS MEMORANDUM OF RESPONSE TO NARA

TABLE OF CONTENTS

DEPARTMENT OF THE TREASURY

INTERNAL REVENUE SERVICE

RECORDS MANAGEMENT INSPECTION REPORT

INTRODUCTION

The National Archives and Records Administration (NARA) is responsible for assisting federal agencies in the proper management of records in all media to protect rights assure government accountability and to preserve records of enduring value

In this capacity NARA inspects the records and information management programs of agencies to ensure compliance with federal laws and statutes and to investigate specific issues or concerns Then NARA works with agencies to make improvements to their programs based on inspection findings and recommendations NARA also identifies best practices that could help other agencies

Congress through the Consolidated and Further Continuing Appropriations Act of 2015 directed the Archivist of the United States to conduct an inspection of the Internal Revenue Servicersquos (IRS) compliance with the provisions of Chapters 29 31 and 33 of Title 44 United States Code (USC) during calendar years 2009 through 2013 The Act required that NARA complete the inspection and report to the appropriate Congressional committees within 180 days of enactment In carrying out this responsibility and based on the authority granted to our agency in 44 USC 2904(c)(7) and 2906 NARA conducted an inspection of the Records and Information Management (RIM) Program of the IRS

BRIEF AGENCY DESCRIPTION

The 16th Amendment to the US Constitution established an income tax In the 1950s the agencyrsquos name was changed from the Bureau of Internal Revenue to its current name the Internal Revenue Service The IRS is a bureau of the Department of the Treasury Its mission is to provide American taxpayers top quality services by helping them understand and meet their tax responsibilities and to enforce the law with integrity and fairness to all1

Tax collection is governed by Title 26 of the US Code Internal Revenue Code Handling of taxpayer information and records are covered by Title 26 of the Code of Federal Regulations (CFR) Subtitle F Procedures and Administration Confidentiality non-disclosure and other protection of taxpayer information are specifically covered under 26 CFR 6103

1 httpwwwirsgov

Page 1

The IRS is organized to carry out the responsibilities of the Secretary of the Treasury under section 7801 of the Internal Revenue Code Section 7803 of the Internal Revenue Code provides for the appointment of a Commissioner of Internal Revenue to administer and supervise the execution and application of the internal revenue laws The IRS is divided into three Commissioner-level organizations

Commissioner Internal Revenue - Specialized IRS units report directly to the Commissioners Office The IRS Chief Counsel also reports to the Treasury General Counsel on certain matters

Deputy Commissioner for Services and Enforcement - The Deputy Commissioner reports directly to the Commissioner and oversees the four primary operating divisions and other service and enforcement functions

Deputy Commissioner for Operations Support - The Deputy Commissioner reports directly to the Commissioner and oversees the integrated IRS support functions facilitating economy of scale efficiencies and better business practices

In addition to collecting revenue the IRS examines individual and corporate returns conducts criminal investigations related to potential violations of the tax code and handles tax appeals

INSPECTION OBJECTIVE

This inspection was initiated to determine if the RIM Program of the IRS was in compliance with Chapters 29 31 and 33 of Title 44 United States Code between the years 2009 and 2013

In keeping with NARArsquos standard records and information management inspection objectives NARA also sought to determine if the current IRS RIM Program has policies and procedures to ensure records regardless of format are created captured maintained and disposed of in accordance with the records management regulations located at 36 CFR Chapter XII There was particular emphasis on email management other electronic records management records scheduling and implementation and the identification risk assessment and transfer of permanent records

SCOPE AND PURPOSE

This is a comprehensive inspection of the IRS RIM Program

Examining implementation of records management policies standards procedures retention schedules and other tactics

Examining training of staff on their RM roles and responsibilities Emphasizing the importance of electronic records management

Page 2

METHODOLOGY

This inspection was conducted using a combination of site visits teleconferences and a review of received documentation

The inspection team used a detailed checklist based on federal statutes regulations and NARA guidance For a complete checklist see Appendix E

The inspection team reviewed the IRSrsquos responses to the annual Records Management Self-Assessment (RMSA) from 2009 through 2014 and the Senior Agency Official (SAO) for Records Management Annual Report from the Department of the Treasury 2013 and 2014

The IRS provided documentation of records management policies procedures training curriculum metrics covering training and performance goals and measures covering 2009 through current For a summarized list of documents see Appendix A

There were five site visits consisting of meetings with multiple offices During the site visits the NARA inspection team met with the IRSrsquos RIM staff a small sample of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) information technology staff and representatives from the Department of the Treasury Office of Privacy Records and Transparency For a complete list of site visits see Appendix D

There were multiple teleconferences with the IRSrsquos RIM staff

STRUCTURE OF THE REPORT

In accordance with 36 CFR 1239 this report contains

(1) An executive summary (2) Background and purpose of inspection (3) Inspection methodology including offices visited (4) Findings (5) Corrective actions needed and other recommendations and (6) Any necessary appendices such as summaries of each site visit or the inspection instrument

The IRS has provided a memorandum in response to this inspection (See Appendix G)

Page 3

FINDINGS AND RECOMMENDATIONS

Using the parameters established by Congress we examined the IRSrsquos compliance with records management regulations from 2009 through 2013 The inspection also included analysis of current records management processes and future initiatives

NARA makes eight findings and nine recommendations to assist the IRS with its records management program

STATUTES AND REGULATIONS

36 CFR Chapter XII Subchapter B specifies policies for federal agenciesrsquo records management programs relating to proper records creation and maintenance adequate documentation and records disposition The regulations in this Subchapter implement the provisions of 44 USC Chapters 21 29 31 and 33

The Federal Records Act requirements for federal agencies are found in 44 USC Chapter 31 Records Management by Federal Agencies At a high level agency heads are responsible for ensuring several things including

The adequate and proper documentation of agency activities (44 USC 3101)

A program of management to ensure effective controls over the creation maintenance and use of records in the conduct of their current business (44 USC 3102(1))

Compliance with NARA guidance and regulations and compliance with other sections of the Federal Records Act that give NARA authority to promulgate guidance regulations and records disposition authority to federal agencies (44 USC 3102(2) and (3))

The regulations implementing the Federal Records Act are found in 36 CFR Chapter XII Subchapter BmdashRecords Management NARA provides additional guidance to agencies at its records management website - httpwwwarchivesgovrecords-mgmt

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 The IRS RIM Program satisfied the objectives of the relevant regulations which according to 36 CFR 122034 require all agencies to

(a) Assign records management responsibility to a person and office with appropriate authority within the agency to coordinate and oversee implementation of the agency comprehensive records management program principles in sect122032

(b) Advise NARA and agency managers of the name(s) of the individual(s) assigned operational responsibility for the agency records management program

(c) Issue a directive(s) establishing program objectives responsibilities and authorities for the creation maintenance and disposition of agency records

Page 4

(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance storage and disposition practices into agency programs processes systems and procedures

(e) Integrate records management and archival requirements into the design development and implementation of electronic information systems as specified in sect123612

(f) Provide guidance and training to all agency personnel on their records management responsibilities including identification of federal records in all formats and media

(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation in accordance with sect1225 and sect1226 of this Subchapter

(h) Comply with applicable policies procedures and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget and NARA or other agencies as appropriate

(i) Institute controls ensuring that all records regardless of format or medium are properly organized classified or indexed and described and made available for use by all appropriate agency staff and

(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations in this Subchapter2

The IRS RIM Programrsquos policies and procedures meet the elements of the regulations although this inspection identified some conditions that add risk to the program Those conditions are described in the following section

THE IRS RECORDS AND INFORMATION MANAGEMENT PROGRAM

The IRS has a small headquarters-based RIM staff of six people There is a nationwide system of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) charged with a combination of information dissemination and physical responsibilities for the management of records for each business unit There are 14 ARMs and approximately 3000 IRCs This complies with 36 CFR 122034(d) which requires that records management responsibilities be assigned to a network of records liaison officers in program and field offices

2 36 CFR 122034 httpwwwecfrgov

Page 5

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 6: Department of the Treasury Internal Revenue Service

DEPARTMENT OF THE TREASURY

INTERNAL REVENUE SERVICE

RECORDS MANAGEMENT INSPECTION REPORT

INTRODUCTION

The National Archives and Records Administration (NARA) is responsible for assisting federal agencies in the proper management of records in all media to protect rights assure government accountability and to preserve records of enduring value

In this capacity NARA inspects the records and information management programs of agencies to ensure compliance with federal laws and statutes and to investigate specific issues or concerns Then NARA works with agencies to make improvements to their programs based on inspection findings and recommendations NARA also identifies best practices that could help other agencies

Congress through the Consolidated and Further Continuing Appropriations Act of 2015 directed the Archivist of the United States to conduct an inspection of the Internal Revenue Servicersquos (IRS) compliance with the provisions of Chapters 29 31 and 33 of Title 44 United States Code (USC) during calendar years 2009 through 2013 The Act required that NARA complete the inspection and report to the appropriate Congressional committees within 180 days of enactment In carrying out this responsibility and based on the authority granted to our agency in 44 USC 2904(c)(7) and 2906 NARA conducted an inspection of the Records and Information Management (RIM) Program of the IRS

BRIEF AGENCY DESCRIPTION

The 16th Amendment to the US Constitution established an income tax In the 1950s the agencyrsquos name was changed from the Bureau of Internal Revenue to its current name the Internal Revenue Service The IRS is a bureau of the Department of the Treasury Its mission is to provide American taxpayers top quality services by helping them understand and meet their tax responsibilities and to enforce the law with integrity and fairness to all1

Tax collection is governed by Title 26 of the US Code Internal Revenue Code Handling of taxpayer information and records are covered by Title 26 of the Code of Federal Regulations (CFR) Subtitle F Procedures and Administration Confidentiality non-disclosure and other protection of taxpayer information are specifically covered under 26 CFR 6103

1 httpwwwirsgov

Page 1

The IRS is organized to carry out the responsibilities of the Secretary of the Treasury under section 7801 of the Internal Revenue Code Section 7803 of the Internal Revenue Code provides for the appointment of a Commissioner of Internal Revenue to administer and supervise the execution and application of the internal revenue laws The IRS is divided into three Commissioner-level organizations

Commissioner Internal Revenue - Specialized IRS units report directly to the Commissioners Office The IRS Chief Counsel also reports to the Treasury General Counsel on certain matters

Deputy Commissioner for Services and Enforcement - The Deputy Commissioner reports directly to the Commissioner and oversees the four primary operating divisions and other service and enforcement functions

Deputy Commissioner for Operations Support - The Deputy Commissioner reports directly to the Commissioner and oversees the integrated IRS support functions facilitating economy of scale efficiencies and better business practices

In addition to collecting revenue the IRS examines individual and corporate returns conducts criminal investigations related to potential violations of the tax code and handles tax appeals

INSPECTION OBJECTIVE

This inspection was initiated to determine if the RIM Program of the IRS was in compliance with Chapters 29 31 and 33 of Title 44 United States Code between the years 2009 and 2013

In keeping with NARArsquos standard records and information management inspection objectives NARA also sought to determine if the current IRS RIM Program has policies and procedures to ensure records regardless of format are created captured maintained and disposed of in accordance with the records management regulations located at 36 CFR Chapter XII There was particular emphasis on email management other electronic records management records scheduling and implementation and the identification risk assessment and transfer of permanent records

SCOPE AND PURPOSE

This is a comprehensive inspection of the IRS RIM Program

Examining implementation of records management policies standards procedures retention schedules and other tactics

Examining training of staff on their RM roles and responsibilities Emphasizing the importance of electronic records management

Page 2

METHODOLOGY

This inspection was conducted using a combination of site visits teleconferences and a review of received documentation

The inspection team used a detailed checklist based on federal statutes regulations and NARA guidance For a complete checklist see Appendix E

The inspection team reviewed the IRSrsquos responses to the annual Records Management Self-Assessment (RMSA) from 2009 through 2014 and the Senior Agency Official (SAO) for Records Management Annual Report from the Department of the Treasury 2013 and 2014

The IRS provided documentation of records management policies procedures training curriculum metrics covering training and performance goals and measures covering 2009 through current For a summarized list of documents see Appendix A

There were five site visits consisting of meetings with multiple offices During the site visits the NARA inspection team met with the IRSrsquos RIM staff a small sample of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) information technology staff and representatives from the Department of the Treasury Office of Privacy Records and Transparency For a complete list of site visits see Appendix D

There were multiple teleconferences with the IRSrsquos RIM staff

STRUCTURE OF THE REPORT

In accordance with 36 CFR 1239 this report contains

(1) An executive summary (2) Background and purpose of inspection (3) Inspection methodology including offices visited (4) Findings (5) Corrective actions needed and other recommendations and (6) Any necessary appendices such as summaries of each site visit or the inspection instrument

The IRS has provided a memorandum in response to this inspection (See Appendix G)

Page 3

FINDINGS AND RECOMMENDATIONS

Using the parameters established by Congress we examined the IRSrsquos compliance with records management regulations from 2009 through 2013 The inspection also included analysis of current records management processes and future initiatives

NARA makes eight findings and nine recommendations to assist the IRS with its records management program

STATUTES AND REGULATIONS

36 CFR Chapter XII Subchapter B specifies policies for federal agenciesrsquo records management programs relating to proper records creation and maintenance adequate documentation and records disposition The regulations in this Subchapter implement the provisions of 44 USC Chapters 21 29 31 and 33

The Federal Records Act requirements for federal agencies are found in 44 USC Chapter 31 Records Management by Federal Agencies At a high level agency heads are responsible for ensuring several things including

The adequate and proper documentation of agency activities (44 USC 3101)

A program of management to ensure effective controls over the creation maintenance and use of records in the conduct of their current business (44 USC 3102(1))

Compliance with NARA guidance and regulations and compliance with other sections of the Federal Records Act that give NARA authority to promulgate guidance regulations and records disposition authority to federal agencies (44 USC 3102(2) and (3))

The regulations implementing the Federal Records Act are found in 36 CFR Chapter XII Subchapter BmdashRecords Management NARA provides additional guidance to agencies at its records management website - httpwwwarchivesgovrecords-mgmt

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 The IRS RIM Program satisfied the objectives of the relevant regulations which according to 36 CFR 122034 require all agencies to

(a) Assign records management responsibility to a person and office with appropriate authority within the agency to coordinate and oversee implementation of the agency comprehensive records management program principles in sect122032

(b) Advise NARA and agency managers of the name(s) of the individual(s) assigned operational responsibility for the agency records management program

(c) Issue a directive(s) establishing program objectives responsibilities and authorities for the creation maintenance and disposition of agency records

Page 4

(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance storage and disposition practices into agency programs processes systems and procedures

(e) Integrate records management and archival requirements into the design development and implementation of electronic information systems as specified in sect123612

(f) Provide guidance and training to all agency personnel on their records management responsibilities including identification of federal records in all formats and media

(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation in accordance with sect1225 and sect1226 of this Subchapter

(h) Comply with applicable policies procedures and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget and NARA or other agencies as appropriate

(i) Institute controls ensuring that all records regardless of format or medium are properly organized classified or indexed and described and made available for use by all appropriate agency staff and

(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations in this Subchapter2

The IRS RIM Programrsquos policies and procedures meet the elements of the regulations although this inspection identified some conditions that add risk to the program Those conditions are described in the following section

THE IRS RECORDS AND INFORMATION MANAGEMENT PROGRAM

The IRS has a small headquarters-based RIM staff of six people There is a nationwide system of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) charged with a combination of information dissemination and physical responsibilities for the management of records for each business unit There are 14 ARMs and approximately 3000 IRCs This complies with 36 CFR 122034(d) which requires that records management responsibilities be assigned to a network of records liaison officers in program and field offices

2 36 CFR 122034 httpwwwecfrgov

Page 5

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 7: Department of the Treasury Internal Revenue Service

The IRS is organized to carry out the responsibilities of the Secretary of the Treasury under section 7801 of the Internal Revenue Code Section 7803 of the Internal Revenue Code provides for the appointment of a Commissioner of Internal Revenue to administer and supervise the execution and application of the internal revenue laws The IRS is divided into three Commissioner-level organizations

Commissioner Internal Revenue - Specialized IRS units report directly to the Commissioners Office The IRS Chief Counsel also reports to the Treasury General Counsel on certain matters

Deputy Commissioner for Services and Enforcement - The Deputy Commissioner reports directly to the Commissioner and oversees the four primary operating divisions and other service and enforcement functions

Deputy Commissioner for Operations Support - The Deputy Commissioner reports directly to the Commissioner and oversees the integrated IRS support functions facilitating economy of scale efficiencies and better business practices

In addition to collecting revenue the IRS examines individual and corporate returns conducts criminal investigations related to potential violations of the tax code and handles tax appeals

INSPECTION OBJECTIVE

This inspection was initiated to determine if the RIM Program of the IRS was in compliance with Chapters 29 31 and 33 of Title 44 United States Code between the years 2009 and 2013

In keeping with NARArsquos standard records and information management inspection objectives NARA also sought to determine if the current IRS RIM Program has policies and procedures to ensure records regardless of format are created captured maintained and disposed of in accordance with the records management regulations located at 36 CFR Chapter XII There was particular emphasis on email management other electronic records management records scheduling and implementation and the identification risk assessment and transfer of permanent records

SCOPE AND PURPOSE

This is a comprehensive inspection of the IRS RIM Program

Examining implementation of records management policies standards procedures retention schedules and other tactics

Examining training of staff on their RM roles and responsibilities Emphasizing the importance of electronic records management

Page 2

METHODOLOGY

This inspection was conducted using a combination of site visits teleconferences and a review of received documentation

The inspection team used a detailed checklist based on federal statutes regulations and NARA guidance For a complete checklist see Appendix E

The inspection team reviewed the IRSrsquos responses to the annual Records Management Self-Assessment (RMSA) from 2009 through 2014 and the Senior Agency Official (SAO) for Records Management Annual Report from the Department of the Treasury 2013 and 2014

The IRS provided documentation of records management policies procedures training curriculum metrics covering training and performance goals and measures covering 2009 through current For a summarized list of documents see Appendix A

There were five site visits consisting of meetings with multiple offices During the site visits the NARA inspection team met with the IRSrsquos RIM staff a small sample of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) information technology staff and representatives from the Department of the Treasury Office of Privacy Records and Transparency For a complete list of site visits see Appendix D

There were multiple teleconferences with the IRSrsquos RIM staff

STRUCTURE OF THE REPORT

In accordance with 36 CFR 1239 this report contains

(1) An executive summary (2) Background and purpose of inspection (3) Inspection methodology including offices visited (4) Findings (5) Corrective actions needed and other recommendations and (6) Any necessary appendices such as summaries of each site visit or the inspection instrument

The IRS has provided a memorandum in response to this inspection (See Appendix G)

Page 3

FINDINGS AND RECOMMENDATIONS

Using the parameters established by Congress we examined the IRSrsquos compliance with records management regulations from 2009 through 2013 The inspection also included analysis of current records management processes and future initiatives

NARA makes eight findings and nine recommendations to assist the IRS with its records management program

STATUTES AND REGULATIONS

36 CFR Chapter XII Subchapter B specifies policies for federal agenciesrsquo records management programs relating to proper records creation and maintenance adequate documentation and records disposition The regulations in this Subchapter implement the provisions of 44 USC Chapters 21 29 31 and 33

The Federal Records Act requirements for federal agencies are found in 44 USC Chapter 31 Records Management by Federal Agencies At a high level agency heads are responsible for ensuring several things including

The adequate and proper documentation of agency activities (44 USC 3101)

A program of management to ensure effective controls over the creation maintenance and use of records in the conduct of their current business (44 USC 3102(1))

Compliance with NARA guidance and regulations and compliance with other sections of the Federal Records Act that give NARA authority to promulgate guidance regulations and records disposition authority to federal agencies (44 USC 3102(2) and (3))

The regulations implementing the Federal Records Act are found in 36 CFR Chapter XII Subchapter BmdashRecords Management NARA provides additional guidance to agencies at its records management website - httpwwwarchivesgovrecords-mgmt

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 The IRS RIM Program satisfied the objectives of the relevant regulations which according to 36 CFR 122034 require all agencies to

(a) Assign records management responsibility to a person and office with appropriate authority within the agency to coordinate and oversee implementation of the agency comprehensive records management program principles in sect122032

(b) Advise NARA and agency managers of the name(s) of the individual(s) assigned operational responsibility for the agency records management program

(c) Issue a directive(s) establishing program objectives responsibilities and authorities for the creation maintenance and disposition of agency records

Page 4

(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance storage and disposition practices into agency programs processes systems and procedures

(e) Integrate records management and archival requirements into the design development and implementation of electronic information systems as specified in sect123612

(f) Provide guidance and training to all agency personnel on their records management responsibilities including identification of federal records in all formats and media

(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation in accordance with sect1225 and sect1226 of this Subchapter

(h) Comply with applicable policies procedures and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget and NARA or other agencies as appropriate

(i) Institute controls ensuring that all records regardless of format or medium are properly organized classified or indexed and described and made available for use by all appropriate agency staff and

(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations in this Subchapter2

The IRS RIM Programrsquos policies and procedures meet the elements of the regulations although this inspection identified some conditions that add risk to the program Those conditions are described in the following section

THE IRS RECORDS AND INFORMATION MANAGEMENT PROGRAM

The IRS has a small headquarters-based RIM staff of six people There is a nationwide system of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) charged with a combination of information dissemination and physical responsibilities for the management of records for each business unit There are 14 ARMs and approximately 3000 IRCs This complies with 36 CFR 122034(d) which requires that records management responsibilities be assigned to a network of records liaison officers in program and field offices

2 36 CFR 122034 httpwwwecfrgov

Page 5

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 8: Department of the Treasury Internal Revenue Service

METHODOLOGY

This inspection was conducted using a combination of site visits teleconferences and a review of received documentation

The inspection team used a detailed checklist based on federal statutes regulations and NARA guidance For a complete checklist see Appendix E

The inspection team reviewed the IRSrsquos responses to the annual Records Management Self-Assessment (RMSA) from 2009 through 2014 and the Senior Agency Official (SAO) for Records Management Annual Report from the Department of the Treasury 2013 and 2014

The IRS provided documentation of records management policies procedures training curriculum metrics covering training and performance goals and measures covering 2009 through current For a summarized list of documents see Appendix A

There were five site visits consisting of meetings with multiple offices During the site visits the NARA inspection team met with the IRSrsquos RIM staff a small sample of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) information technology staff and representatives from the Department of the Treasury Office of Privacy Records and Transparency For a complete list of site visits see Appendix D

There were multiple teleconferences with the IRSrsquos RIM staff

STRUCTURE OF THE REPORT

In accordance with 36 CFR 1239 this report contains

(1) An executive summary (2) Background and purpose of inspection (3) Inspection methodology including offices visited (4) Findings (5) Corrective actions needed and other recommendations and (6) Any necessary appendices such as summaries of each site visit or the inspection instrument

The IRS has provided a memorandum in response to this inspection (See Appendix G)

Page 3

FINDINGS AND RECOMMENDATIONS

Using the parameters established by Congress we examined the IRSrsquos compliance with records management regulations from 2009 through 2013 The inspection also included analysis of current records management processes and future initiatives

NARA makes eight findings and nine recommendations to assist the IRS with its records management program

STATUTES AND REGULATIONS

36 CFR Chapter XII Subchapter B specifies policies for federal agenciesrsquo records management programs relating to proper records creation and maintenance adequate documentation and records disposition The regulations in this Subchapter implement the provisions of 44 USC Chapters 21 29 31 and 33

The Federal Records Act requirements for federal agencies are found in 44 USC Chapter 31 Records Management by Federal Agencies At a high level agency heads are responsible for ensuring several things including

The adequate and proper documentation of agency activities (44 USC 3101)

A program of management to ensure effective controls over the creation maintenance and use of records in the conduct of their current business (44 USC 3102(1))

Compliance with NARA guidance and regulations and compliance with other sections of the Federal Records Act that give NARA authority to promulgate guidance regulations and records disposition authority to federal agencies (44 USC 3102(2) and (3))

The regulations implementing the Federal Records Act are found in 36 CFR Chapter XII Subchapter BmdashRecords Management NARA provides additional guidance to agencies at its records management website - httpwwwarchivesgovrecords-mgmt

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 The IRS RIM Program satisfied the objectives of the relevant regulations which according to 36 CFR 122034 require all agencies to

(a) Assign records management responsibility to a person and office with appropriate authority within the agency to coordinate and oversee implementation of the agency comprehensive records management program principles in sect122032

(b) Advise NARA and agency managers of the name(s) of the individual(s) assigned operational responsibility for the agency records management program

(c) Issue a directive(s) establishing program objectives responsibilities and authorities for the creation maintenance and disposition of agency records

Page 4

(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance storage and disposition practices into agency programs processes systems and procedures

(e) Integrate records management and archival requirements into the design development and implementation of electronic information systems as specified in sect123612

(f) Provide guidance and training to all agency personnel on their records management responsibilities including identification of federal records in all formats and media

(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation in accordance with sect1225 and sect1226 of this Subchapter

(h) Comply with applicable policies procedures and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget and NARA or other agencies as appropriate

(i) Institute controls ensuring that all records regardless of format or medium are properly organized classified or indexed and described and made available for use by all appropriate agency staff and

(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations in this Subchapter2

The IRS RIM Programrsquos policies and procedures meet the elements of the regulations although this inspection identified some conditions that add risk to the program Those conditions are described in the following section

THE IRS RECORDS AND INFORMATION MANAGEMENT PROGRAM

The IRS has a small headquarters-based RIM staff of six people There is a nationwide system of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) charged with a combination of information dissemination and physical responsibilities for the management of records for each business unit There are 14 ARMs and approximately 3000 IRCs This complies with 36 CFR 122034(d) which requires that records management responsibilities be assigned to a network of records liaison officers in program and field offices

2 36 CFR 122034 httpwwwecfrgov

Page 5

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 9: Department of the Treasury Internal Revenue Service

FINDINGS AND RECOMMENDATIONS

Using the parameters established by Congress we examined the IRSrsquos compliance with records management regulations from 2009 through 2013 The inspection also included analysis of current records management processes and future initiatives

NARA makes eight findings and nine recommendations to assist the IRS with its records management program

STATUTES AND REGULATIONS

36 CFR Chapter XII Subchapter B specifies policies for federal agenciesrsquo records management programs relating to proper records creation and maintenance adequate documentation and records disposition The regulations in this Subchapter implement the provisions of 44 USC Chapters 21 29 31 and 33

The Federal Records Act requirements for federal agencies are found in 44 USC Chapter 31 Records Management by Federal Agencies At a high level agency heads are responsible for ensuring several things including

The adequate and proper documentation of agency activities (44 USC 3101)

A program of management to ensure effective controls over the creation maintenance and use of records in the conduct of their current business (44 USC 3102(1))

Compliance with NARA guidance and regulations and compliance with other sections of the Federal Records Act that give NARA authority to promulgate guidance regulations and records disposition authority to federal agencies (44 USC 3102(2) and (3))

The regulations implementing the Federal Records Act are found in 36 CFR Chapter XII Subchapter BmdashRecords Management NARA provides additional guidance to agencies at its records management website - httpwwwarchivesgovrecords-mgmt

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 The IRS RIM Program satisfied the objectives of the relevant regulations which according to 36 CFR 122034 require all agencies to

(a) Assign records management responsibility to a person and office with appropriate authority within the agency to coordinate and oversee implementation of the agency comprehensive records management program principles in sect122032

(b) Advise NARA and agency managers of the name(s) of the individual(s) assigned operational responsibility for the agency records management program

(c) Issue a directive(s) establishing program objectives responsibilities and authorities for the creation maintenance and disposition of agency records

Page 4

(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance storage and disposition practices into agency programs processes systems and procedures

(e) Integrate records management and archival requirements into the design development and implementation of electronic information systems as specified in sect123612

(f) Provide guidance and training to all agency personnel on their records management responsibilities including identification of federal records in all formats and media

(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation in accordance with sect1225 and sect1226 of this Subchapter

(h) Comply with applicable policies procedures and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget and NARA or other agencies as appropriate

(i) Institute controls ensuring that all records regardless of format or medium are properly organized classified or indexed and described and made available for use by all appropriate agency staff and

(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations in this Subchapter2

The IRS RIM Programrsquos policies and procedures meet the elements of the regulations although this inspection identified some conditions that add risk to the program Those conditions are described in the following section

THE IRS RECORDS AND INFORMATION MANAGEMENT PROGRAM

The IRS has a small headquarters-based RIM staff of six people There is a nationwide system of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) charged with a combination of information dissemination and physical responsibilities for the management of records for each business unit There are 14 ARMs and approximately 3000 IRCs This complies with 36 CFR 122034(d) which requires that records management responsibilities be assigned to a network of records liaison officers in program and field offices

2 36 CFR 122034 httpwwwecfrgov

Page 5

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 10: Department of the Treasury Internal Revenue Service

(d) Assign records management responsibilities in each program (mission) and administrative area to ensure incorporation of recordkeeping requirements and records maintenance storage and disposition practices into agency programs processes systems and procedures

(e) Integrate records management and archival requirements into the design development and implementation of electronic information systems as specified in sect123612

(f) Provide guidance and training to all agency personnel on their records management responsibilities including identification of federal records in all formats and media

(g) Develop records schedules for all records created and received by the agency and obtain NARA approval of the schedules prior to implementation in accordance with sect1225 and sect1226 of this Subchapter

(h) Comply with applicable policies procedures and standards relating to records management and recordkeeping requirements issued by the Office of Management and Budget and NARA or other agencies as appropriate

(i) Institute controls ensuring that all records regardless of format or medium are properly organized classified or indexed and described and made available for use by all appropriate agency staff and

(j) Conduct formal evaluations to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations in this Subchapter2

The IRS RIM Programrsquos policies and procedures meet the elements of the regulations although this inspection identified some conditions that add risk to the program Those conditions are described in the following section

THE IRS RECORDS AND INFORMATION MANAGEMENT PROGRAM

The IRS has a small headquarters-based RIM staff of six people There is a nationwide system of Area Records Managers (ARMs) and Information Resource Coordinators (IRCs) charged with a combination of information dissemination and physical responsibilities for the management of records for each business unit There are 14 ARMs and approximately 3000 IRCs This complies with 36 CFR 122034(d) which requires that records management responsibilities be assigned to a network of records liaison officers in program and field offices

2 36 CFR 122034 httpwwwecfrgov

Page 5

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 11: Department of the Treasury Internal Revenue Service

The responsibility of ARMs and IRCs is to provide records management guidance IRCs under the guidance of the ARMs are responsible for files planning and inventorying in each office and for updating as required with recordkeeping format changes The ARMs and IRCs the inspection team interviewed handled mostly paper processes

The Internal Revenue Manual (IRM) is the official source of instructions to IRS staff for processes procedures and guidelines for daily business operations Records and information management policies are in Section 115 This section is also known as the Records Management Handbook or simply The Handbook3

The Handbook is divided into various topical sections covering a wide variety of records and information management policies routines procedures and requirements which indicates compliance with 36 CFR 122034(c) and 36 CFR 1222 through 1238 It is updated periodically as needed The instructions are very detailed thorough and easy to follow The Handbook is web-based and widely available to all staff

While the RIM Program complies with the regulations there are areas of concern As a result this inspection makes the following findings and recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

The IRS email system runs on Microsoft Outlook and is stored on email servers at the IRS data centers Approximately 170 terabytes of email are currently stored on the email servers The daily backup provides a snapshot of the contents of all email boxes at the time the backup is run The IRS limits the total volume of email stored on the servers by restricting the amount of email most individual users can keep in an inbox at any given time The IRS does not automatically delete emails rather each employee is responsible for managing and prioritizing the information in their email box

The IRS has historically stored email as Personal Storage Table (PST) files on individual hard drives with the exception of the employees of the Chief Counsel The PST files of Chief Counsel employees reside on a server The IRS has recognized the risks of storing PST files on the hard drives of individual staff and has mitigated this risk somewhat by moving Senior Officialsrsquo email to network locations

The RIM Program has issued policies guidance and training for staff on managing emails Employees must determine if the content of an email qualifies it as a record using the definition of a record under 44 USC 3301 Most of the IRSrsquos business units do not have an email archive or recordkeeping system The policy of the IRS in compliance with 36 CFR 123622(c)(2)(f) largely has been to print email records and file them in accordance with their records control schedule

3 Internal Revenue Manual httpwwwirsgovirmpart1irm_01-015-001html

Page 6

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 12: Department of the Treasury Internal Revenue Service

Recommendation 11 The IRS needs to manage all agency email in a manner that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Under the provisions of 36 CFR 123010 agencies are responsible for implementing and disseminating policies and procedures to protect records against loss or destruction Because it is impossible to totally prevent incidents agencies must report such loss promptly to NARA under 36 CFR 123014

Having the proper mechanics of records management in place does not guarantee that all records will be properly maintained at all times or prevent the loss of information due to accidents mistakes and disasters However having such policies and procedures does inform staff of their records management responsibilities and provides instructions for when records are lost or damaged

The IRS Records Management Handbook 1153 Disposing of Records clearly states that

Employees should report in writing to their ARM or the IRS Records Officer any unauthorized unlawful or accidental destruction defacing or alteration of records in their custody or the Servicersquos custodyhellip The IRS Records Officer must furnish a report to the National Archives and Records Administration (NARA) after each incident of erroneous destruction4

Although this section of the Handbook was revised in 2013 the wording for reporting unauthorized disposal was not changed

The IRS has but does not consistently follow procedures concerning loss or potential loss of records The IRS rarely reports erroneous or unauthorized disposal of records to NARA In interviews with the IRSrsquos staff it was clear they were aware that the loss of records must be reported to the records officer but there is confusion as to what constitutes a reportable loss

4 Ibid This section of the Handbook was revised November 1 2013 and was the current version of this section in use at the time of this inspection The material changes to this section include new references to the IRS Records Control Schedules and the General Records Schedule (published by NARA for records that most agencies have in common) The wording for reporting unauthorized disposal was not changed

Page 7

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 13: Department of the Treasury Internal Revenue Service

The regulations to notify NARA do not indicate how significant a records loss must be to require reporting But there is some evidence that the IRSrsquos staff believed that the loss of records should be reported only when the loss was intentional or permanent records were involved Some of this confusion is due to the fact that there are normally multiple copies of electronic records Thus a loss by one custodian may not be a loss from the agencyrsquos perspective

The IRS otherwise makes considerable effort to ensure the proper management of its records and information This includes ensuring the normal implementation of records control schedules and disposal procedures are routinely followed The ARMs and IRCs are involved in office relocations records clean up days requests for additional storage equipment and other activities that bring potential failures to implement disposition properly to their attention There are also procedures to document routine disposal of records in accordance with retention schedules

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRSrsquos RIM Program staff and subsequently to NARA

Finding 3 The IRSrsquos data management procedures do not adequately engage RIM staff when records may be in jeopardy

The IRSrsquos Information Technology (IT) is responsible for data management and storage Within IT responsibility for data management and storage is split between several locations in order to provide security and redundancy The NARA inspection team was briefed on the activities of the IRSrsquos data centers and toured the Martinsburg West Virginia facility This briefing focused on the data protection and recovery efforts carried out by Enterprise Operations (EOPS) These efforts include two main activities the management of the IRSrsquos backup infrastructure environment and the custodianship of physical media including tapes and hard drives The staff at the data center works closely with colleagues at the IRSrsquos New Carrollton facility to ensure the integrity and security of the IRSrsquos electronic systems and to facilitate data retrieval and recovery when necessary

However there needs to be better communication with RIM Program staff when data loss might indicate records loss The current procedure is

Loss of computers and other cyber security incidents are reported to the Cyber Security Incident Reporting Center (CSIRC)

Cyber security incidents identified by or reported to the CSIRC are assessed to determine the nature and severity of events to formulate a prompt response for containment and eradication thereby minimizing impact

Reported incidents are documented within the CSIRC centralized Incident Tracking System (ITS) and further triaged to determine validity severity and impact of the event as well as any legal or criminal ramifications

Page 8

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 14: Department of the Treasury Internal Revenue Service

As mandated by Treasury Department Publication TDP 85-01 the CSIRC team analyzes each incident type to determine the severity and assigns them to the appropriate Federal Agency Incident Category and further reports the incidents to the Treasury CSIRC (TCSIRC)

The incident categories provide the Federal Government and supported organizations a common taxonomy when reporting incidents and events

The CSIRC reporting procedures reveal no required steps for notifying the IRS RIM Program staff of potential data loss Currently when systems are compromised RIM Program staff is unaware of what records may be in jeopardy and cannot respond internally or to NARA as required The IRS should resolve how RIM Program staff learns about any potential loss of records due to data failure

Additionally as part of the employee separation processes the IRS recycles hard drives This involves removing used hard drives and removing any remaining files by degaussing There are no standardized procedures to ensure that remaining files have been reviewed for record material Degaussing without determining that all records have been properly dispositioned could constitute an unauthorized or erroneous disposal in violation of 36 CFR 123010 The RIM Program has not previously been involved in this process but is working with IT and other stakeholders to develop criteria for managers and separating employees to ensure that all record material has been appropriately secured in a recordkeeping environment prior to degaussing

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

The IRS has three data centers to handle exchange email including live redundancy (daily incremental) and weekly full backups Linear Tape-Open (LTO) tapes are used to store copies of the IRSrsquos email Prior to April 2013 these tapes were retained for six months and recycled The practice of retaining backup tapes for six months is consistent with the NARA-issued General Records Schedule (GRS 24 item 4)5

In reaction to recent audit and Congressional hearings a freeze was put in place preventing the recycling of backup tapes This is normal procedure when records are needed for audit and other administrative or legal purposes It is our understanding that a change in policy was made to stop recycling backup tapes even after they are no longer needed for audit purposes

5 General Records Schedules (GRS) httpwwwarchivesgovrecords-mgmtgrshtml

Page 9

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 15: Department of the Treasury Internal Revenue Service

As of July 1 2014 all backup tapes of the IRSrsquos email systems are retained indefinitely per current standing order from the IRSrsquos senior management Staff at the IRS Martinsburg facility document a significant increase in the number of backup tapes that they are now having to purchase because new ones can no longer be recycled The total number of backups used by the facility currently stands at 38000 LTO tapes In addition backup tapes of shared drives for senior executives are also kept indefinitely There has been no discussion to determine under what circumstances this ban on recycling of backup tapes could be lifted When no longer needed for audit and legal purposes continued indefinite retention of email backup tapes and executive level shared drives is not cost effective This practice results in a significant increase in the space required for tape storage

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

The IRM Chapter 115 Records and Information Management formerly included all records control schedules including General Records Schedules In April 2010 the General Records Schedules were removed from the IRM and published in IRS Document 12829 In August 2013 the majority of the IRSrsquos program related records control schedules were moved to IRS Document 12990 with some remaining in IRM 115 because they are pending revision As revisions are made the remaining schedules will be moved so that eventually all records control schedules will be in one location

IRS Document 12990 includes descriptions and instructions for retention and disposition of agency program records Its structure is typical of an organizational records control schedule It is divided into 29 chapters containing several hundred individual items totaling over 500 pages

The use of granular organizationally-based retention schedules is less effective in digital environments because they are cumbersome and expensive to program into electronic recordkeeping systems They increase the possibility of confusion errors and lack of adoption in electronic and paper systems by having to apply too many disposition authorities In contrast a functional schedule can substantially reduce the number of disposition authorities This will help with the implementation of electronic records management by decreasing the amount of time required to set up user profiles based on fewer disposition authorities

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Page 10

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 16: Department of the Treasury Internal Revenue Service

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

The IRS encrypts its email and other electronic records to protect the privacy of taxpayer information confidentiality and the IRSrsquos techniques and practices NARArsquos transfer guidance requires agencies remove or deactivate encryption before the records may be transferred6

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

While the current ARM and IRC structure enables the RIM Program staff to implement policies and procedures in every business unit ARMs perform records management functions as one of several unrelated collateral duties This limits the ARMsrsquo availability to perform audits or inspections of the records practices in each unit

ARMs and IRCs play an important role in the RIM Programrsquos records risk mitigation strategy They work collaboratively to follow strict agency protocols and procedures in the transfer of records to and from Federal Records Centers (FRC) They coordinate and document all in-house records disposals and validate FRC disposals The ARMs record a variety of metrics and records activities in an ARM Metrics Library including

Comprehensive IRC identification for all Posts of Duties (PODs) in their area IRCs Enterprise Learning Management training completion Records inventory completion and files plan development Listing of all training delivered

Procedures require that ARMs and IRCs periodically review records management practices in their areas of responsibility According to the IRSrsquos policy the ARMs should annually review 25 of the units assigned to them However the ARMs interviewed for this inspection indicated that they are able to only review a small percentage (one to three percent) of the units assigned to them They also indicated that reviews covered paper-based processes almost exclusively

The IRS RIM Program has a virtual assessment and self-certification tool While clearly dependent on the veracity of the self-reported data this method has proven to be a viable solution for those ARMs who are using it However the virtual assessment covers only paper-based processes

6 NARA Bulletin 2014-01 Revised Format Guidance for the Transfer of Permanent Electronic Records httpwwwarchivesgovrecords-mgmtbulletins20142014-04html

Page 11

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 17: Department of the Treasury Internal Revenue Service

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

According to 36 CFR 122410(e) agencies must provide training and guidance to all employees on agency records disposition requirements and procedures and other significant aspects of the records disposition program When a new or revised records schedule is issued agencies must provide specific guidance to employees responsible for applying the schedule7

In accordance with the regulation the IRS RIM Program communicates RM policies changes in regulations NARA guidance and updated records control scheduling through a wide range of methods The IRS RIM Program provided sample documentation to the inspection team of its methods for sharing information and training including

Guidance on RM topics Brochures Webinars Instructor-led training Newsletters Topical awareness bulletins Employee orientation for new employees

A demonstration of web-based training modules showed that an extensive effort is made to ensure that up-to-date information is available to staff The information is clear concise organized and available There is required training for employees assigned as ARMs This same course is recommended but not required for IRCs Of the approximately 3000 IRCs 80 have completed the training The ARMs provide information sessions to staff in their business units These are tracked and statistics sent to the agency records officer

Although training about records management responsibilities is available it is evident that not all staff takes the training While there is a small inclusion of records management topics in required training on privacy and non-disclosure of taxpayer information RIM training is not mandatory for all IRS staff

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

7 36 CFR 122410(e) httpwwwecfrgov

Page 12

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 18: Department of the Treasury Internal Revenue Service

ONGOING IMPROVEMENT PROJECTS

NARA maintains an open and collaborative relationship with agencies in order to help them achieve their records management goals and responsibilities As part of this activity NARA continuously assesses the progress of agency records management initiatives IRS has started the following activities and projects to improve their RIM Program NARA is encouraged by these developments and looks forward to supporting the IRS in these ongoing projects

The IRS is reorganizing its records management program

The IRS RIM Program is currently being reorganized This reorganization will be completed by the end of 2015 Specifically the program is moving from Agency Wide Shared Services (AWSS)Facilities Management and Security Services (FMSS) to Privacy Governmental Liaison and Disclosure (PGLD) The IRS believes this change will raise the visibility and strengthen the RIM Program by aligning agency-wide records management requirements with processes to ensure the protection of taxpayer information as a whole The IRS anticipates this alignment will achieve the following

Improve governance of electronic systems and electronic records (including email) thereby ensuring records management compliance

Prioritize records management as part of the overarching privacy protection strategy

Include records management as a critical part in strategic planning for risk management

Increase attention to records disposition requirements thereby improving records management efficiencies and effectiveness while reducing privacy risks and operating costs

Improve records and privacy awareness through combined training and communications

The IRS is working to improve document management and email systems with records management functionality

According to 36 CFR 12366 the IRS is required to integrate records management and preservation considerations into the design development enhancement and implementation of electronic information systems8 This regulation applies to structured and unstructured data The IRS Handbook addresses this requirement in 1156 The IRS provided the inspection team with two versions of the Handbook June 2010 and March 2014 Both versions of the Handbook effectively covered the creation maintenance use and disposition of federal records (including email) created by electronic information systems computers and other electronic devices

836 CFR 12366 httpwwwecfrgov

Page 13

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 19: Department of the Treasury Internal Revenue Service

Beginning in 2005 recognizing the importance of both document management (DM) and records management (RM) technology for the IRSrsquos business processes the IRS initiated an effort to unify and standardize its DM environment around industry standards and Commercial Off-the-Shelf (COTS) software Over the past decade there have been various efforts to create a document and email system with records management functionality but funding constraints and other IT infrastructure priorities prevented an agency-wide system Individual business units had success in using collaboration and document management systems such as Documentum and Autonomy However none of these systems managed email effectively nor were they effectively integrated with each other The cost and lack of suitable technology during this time period were given as reasons why a system had not been possible Current efforts will improve the IRSrsquos capabilities in this area if they are implemented

Electronic management efforts at the IRS have been bolstered by the Managing Government Records Directive (M-12-18)9 The Directive jointly issued by OMB and NARA in 2012 has placed deadlines for agencies to manage email electronically by December 31 2016 and to manage all permanent electronic records electronically by December 31 2019 The IRS has been working to meet these goals through a modernization and re-organization plan If successful this plan will assist the IRS with the transition to a 21st Century RIM Program

The IRS established the Enterprise eRecords Management Team (EeRMT) to identify and implement records management solutions for all electronic records including email The EeRMT is a cross-functional team with representatives from business units across the IRS The larger team is divided into the following sub-teams and responsibilities

Requirements Team ndash This team is responsible for identifying high-level program requirements for full electronic records management

Technology Team ndash This team is responsible for identifying technical requirements and reviewing current IRS-owned software against high-level requirements

PolicyCompliance Team ndash This team is responsible for developing policy and compliance documents for enterprise-wide electronic records management

Communications Team ndash This team is responsible for communicating EeRMT status updates and other electronic records-related information

Training Team ndash This team is responsible for developing required records management and end user training

9 OMBNARA Managing Government Records Directive (M-12-18) httpswwwwhitehousegovsitesdefaultfilesombmemoranda2012m-12-18pdf

Page 14

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 20: Department of the Treasury Internal Revenue Service

In conjunction with the EeRMT effort RIM Program staff is working to implement the out-of-the-box records management functionality of Microsoft SharePoint for agency-wide use As of April 2015 all SharePoint 2003 and 2007 sites were migrated to SharePoint 2010 The IRS will use the Records Center application and in-place records management capabilities within SharePoint A pilot project with 65 employees is underway Following the pilot the IRS will roll out a SharePoint RM site in the Wage and Investment Division and eventually agency wide by 2019 SharePoint RM will not be used to manage email

There is a great deal of time and effort needed to develop the SharePoint RM profiles and rules for each business unit in order for the approach to work In addition training will be necessary for all users of the system as it is rolled out for use RIM Program staff will need to work closely with business units to create a system that is user-friendly Once this work is completed the IRS needs to train staff have policies in place that require its use and ensure compliance with RM policies At the time of the inspection implementation was only in the initial stages

The IRS is implementing the Capstone approach to managing email

In August 2013 NARA introduced Guidance on a New Approach to Managing Email also known as ldquoCapstonerdquo10 For more information on the Capstone approach see NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email

The IRS has taken steps to implement the Capstone approach consistent with NARA Bulletin 2013-02 The IRS has identified and provided training to likely Capstone officials The IRS has proposed a retention schedule to schedule their email records that is currently being reviewed by NARA

This schedule proposes a three-tiered approach for managing IRS email

Tier 1 for Capstone Official account holders includes 32 accounts These individuals are the top-tier of agency management This item proposes permanent retention

Tier 2 for Executive and Senior Manager account holders includes 290 accounts These second-tier or mid-level managers represent primarily directors of operating divisions who report directly to Capstone officials This item proposes a 15 year retention

Tier 3 for the approximately 90000 remaining employees who process returns support the IRS helpline maintain infrastructure and perform other routine andor administrative functions This item proposes a 7 year retention

10NARA Bulletin 2013-02 Guidance on a New Approach to Managing Email August 20 2013 httpwwwarchivesgovrecords-mgmtbulletins20132013-02html

Page 15

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 21: Department of the Treasury Internal Revenue Service

This proposed schedule will be available for public review in the fourth quarter of FY 15 through the Federal Register consistent with the schedule review process11 Pending NARA approval all email is being retained until the new schedule is approved and other issues regarding backup tapes are resolved

The IRS is seeking to increase accountability for electronic records management by including related commitments in the FY 15 performance plans of PGLD leadership and RIM Program staff

One of the ways to make measurable changes is through accountability In support of the importance of records management and electronic records in particular PGLD leadership and RIM staff have electronic records related commitments in their FY 15 performance plans

For example

PGLD Leadership Commitments o Develop electronic email archive solution by December 2016 o Develop interim electronic email archive for IRS executives that provides a

bridge to a long term records retention solution

RIM Staff Commitments o Lead a team in the policy planning for records and content management

functionality in Microsoft SharePoint o Develop a project plan for electronic records to meet Executive Order deadlines

The IRS is implementing plans to appoint a permanent Agency Records Officer

During the course of this inspection the IRS Records Officer retired The IRS is required by the 36 CFR 122034 to assign a records officer responsible for overseeing the day-to-day-operations of its records program To cover the duties of the retired Agency Records Officer two current Senior Records Analysts will serve consecutive details until the IRS is able to permanently fill the position

11 Records Schedule Review Process httpwwwarchivesgovrecords-mgmtpolicyrecords-schedule-review-processhtml

Page 16

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 22: Department of the Treasury Internal Revenue Service

CONCLUSION

The IRS RIM Program was sufficiently compliant with the statutes and regulations prescribed by 36 CFR Chapter XII Subchapter B during the period of 2009 through 2013 While this inspection identified several conditions that currently add risk to the IRSrsquos records management operations the IRS RIM Program generally meets statutory and regulatory requirements A compliant program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness The IRS generally but not entirely met this standard from the period of 2009 to present This report discusses specific areas where the standard was not fully met for email and other information systems that electronically create and maintain records

Page 17

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 23: Department of the Treasury Internal Revenue Service

APPENDIX A SELECT PRE-INSPECTION DOCUMENTS

Records Management Program

Records Management Self-Assessment Responses 2009 ndash 2014 Department of the Treasury Senior Agency Official Reports on Implementing

OMBNARA Managing Government Records Directive (M-12-18) 2013 and 2014 Internal Revenue Manual (IRM) Chapters 115 Records Management Handbook

o Current as publically available on the web o Revisions and changes between 2009 ndash 2014

IRS Document 12990 ndash Records Control Schedules IRS Document 12829 ndash General Records Schedules National Institute of Standards and Technology (NIST) Appendix J of Section 800-53 Executive Briefing Deck for RIM Analysis RIM Transition Action Plan Documentation from ARMs and IRCs

o Inspection or evaluation reports o Subsequent reports o Follow-up actions o Outreach and training

RIM Program strategic plans goals and objectives IRS records management policies directives standards and other RIM related

tacticsissuances Organizational charts and structure of IRS RIM staff andor network of liaisons Sample documents for IRS RIM training curriculum materials and attendance records RIM Program Action Plans RIM Program Goals and Work plans RIM Business Objectives

Email

Documentation on document management and email systems and records management applications proposals

Draft Capstone SF 115 Requests for Information (RFI) Email Records Management Capstone Officials Procedures for back-up and recovery for email and other electronic information systems

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 24: Department of the Treasury Internal Revenue Service

Appendix A

Policies and Standard Operating Procedures and Guidance

Desk Guide to Retire Records IRS Guide 9493 Introduction to Records at the IRS IRS National Records Policy Regarding Virtual Office IRS RIM Records Management Process Map Description of IRS Email Collection Production IRS Email Guidance on Managing Electronic Mail Maintaining Your Outlook 2010 Mailbox FAQs Email Records Interim Records Retention Policy on Email IRS Quick Job Aid on In-House Disposal of Records Guidance on Disposal of IRS Documents FAQ RIM Guidance on Identification of Permanent Records RIM Guidance on Instant Messaging RIM Guidance on SharePoint Site Clean Up Computer Incident Reporting Procedures

Page A-2

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 25: Department of the Treasury Internal Revenue Service

APPENDIX B AUTHORITIES AND FOLLOW-UP ACTIONS

AUTHORITIES

44 USC Chapter 29

36 CFR Chapter XII Subchapter B

36 CFR 1239 Program Assistance and Inspections

FOLLOW-UP ACTIONS

ACTION PLAN

The IRS will submit to NARA a Plan of Corrective Action (PoCA) that specifies how the agency will address each inspection report recommendation including a timeline for completion and proposed progress reporting dates

The plan must be submitted within 60 days after the date of transmittal of the final report to the head of the agency

PROGRESS REPORTS

The IRS will submit to NARA progress reports on the implementation of the action plan until all actions are completed

NARA REVIEW

NARA will analyze the adequacy of the IRSrsquos action plan provide comments to the IRS on the plan within 60 calendar days of receipt assist the IRS in implementing recommendations and inform the IRS when progress reports are no longer needed

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 26: Department of the Treasury Internal Revenue Service

APPENDIX C FINDINGS AND RECOMMENDATIONS

Finding 1 The IRSrsquos current email management practices and technologies do not secure all record email against potential loss

Recommendation 11 The IRS needs to manage all agency email in a manner that that ensures reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on staff hard drives and shared drives and migrate legacy email to an electronic records management system so that the IRS can more effectively manage email consistent with their business needs and NARA regulations and policies

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures and guidance to clearly define when and how records loss or potential records loss is identified and managed within the agency particularly how and when such loss is reported to the IRS RIM Program staff and subsequently to NARA

Finding 3 The IRS data management procedures do not adequately engage RIM staff when records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data should be revised to include notification and coordination with the RIM Program to mitigate potential loss of records

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup tapes indefinitely implement compliant electronic email management and recycle backup tapes according to regulation and best practices

Finding 5 The IRSrsquos granular organizationally-based records control schedules are cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records schedules into a functional style that is more conducive to electronic records management

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 27: Department of the Treasury Internal Revenue Service

Appendix C

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take without decryption

Recommendation 6 The IRS should modify its records management policies to include procedures to decrypt permanent email before transfer to NARA

Finding 7 The IRS RIM Program has limited capacity to monitor the implementation of records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records practices in IRS business units including units where records are electronically maintained NARA would like to see the plan as well as evidence of its implementation

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior Officials

Recommendation 8 The IRS should develop and implement mandatory records management training including electronic records management for all staff

Page C-2

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 28: Department of the Treasury Internal Revenue Service

OFFICES VISITED DURING INSPECTION

Crystal City Virginia Records and Information Management

New Carrollton Maryland Small BusinessSelf Employed Information Technology Strategy amp Planning Information Technology Network Services

Philadelphia Pennsylvania Wage and Investment Centralized Case Processing Human Capital Office Office of General Counsel

Ogden Utah Submission Processing Service Center Accounting Operations

o Federal Tax Deposit and Electronic Federal Tax Payment System o Payment Correction o Revenue Accounting o Erroneous RefundsRefund Litigation o Excess CollectionManual RefundsRefund InterceptAccount Transfers o Income Verification Services o Data ControlReports

Statistics of Income Operation (SOI) Document Perfection Operation

o Code and Edit Department o Entity teams

Input Correction Operation o Error ResolutionRejects o Rejects o UnpostablesNotice Review o Document Retention (not the same as records management terms)

Receipt and Control Operation o Extracting Departments o Deposit Department

Data Conversion Operation o Integrated Submission and Remittance Processing (ISRP)

APPENDIX D

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 29: Department of the Treasury Internal Revenue Service

Appendix D

Site Coordinator (primary support services) o Planning and Analysis Operation o Work Planning and Control

Martinsburg West Virginia Enterprise Computing Center

Dallas Texas Tax Exempt Government Entities

Report Generation Software System (RGS)

Reporting Compliance Case Management System (RCCMS)

Page D-2

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 30: Department of the Treasury Internal Revenue Service

APPENDIX E SELECTED COMPLIANCE QUESTIONS

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

PROGRAM REQUIREMENTS

A compliant effective and efficient federal records management program requires senior management support at the highest levels a clear definition of program objectives responsibilities and authorities allocation of sufficient resources to administer the program assignment of the program to an appropriate office within the agencyrsquos organizational structure continuous training for records management staff and regular internal evaluations to monitor compliance and program effectiveness Question Has records management responsibility been assigned to a headquarters Records Officer (RO) and office with appropriate authority within the agency to coordinate and oversee implementation of the agency records management program 36 CFR 122034(a) Have records management responsibilities been assigned to a network of records liaison officers (RLOs) in program and field offices to ensure recordkeeping requirements and practices are incorporated into agency programs processes systems and procedures 36 CFR 122034(d) Is the records management program placed appropriately within the agencyrsquos organizational structure Are the RO and RLOs sufficiently represented among management and included on management ldquoteamsrdquo 36 CFR 122034(a) Are lines of communication and control between the RO and the RLOs clear and consistent Do those individuals with responsibility for records management have core competencies consistent with their duties and is this reflected in their position descriptions and performance plans Do those individuals with responsibility for records management have the opportunity for on-going training continuing education and professional development consistent with their responsibilities 36 CFR 122034(f) Does senior management provide adequate resources for the records management program including budget allocations for Maintenance of recordkeeping systems Storage and maintenance of records

Does senior management provide adequate resources for the records management program including budget allocations for continued improvements to records management including additional staff training for staff procurement of equipment and other resources Do records management officials participate in developing new or revised agency programs processes systems and procedures and do they coordinate records management activities with other information management and agency activities in order to ensure that adequate recordkeeping requirements are established and implemented Has a directive been issued establishing program objectives responsibilities and authorities for agency recordkeeping requirements Is it clearly written in accordance with appropriate laws and regulations and kept current 36 CFR 122034(c)

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 31: Department of the Treasury Internal Revenue Service

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the directive state the agencyrsquos commitment to the authorized timely and orderly disposition of records Does the directive designate the agency records officer as the official responsible for the program Does the directive permit delegation of authority to involve all parts of the agency in the program Does the directive establish a network of personnel at major headquarters offices and at field offices to carry on records disposition work under the agency ROrsquos direction 36 CFR 122034(d) Does the directive establish effective controls over all records and non-record materials including email and the need to create and maintain a comprehensive schedule for all records regardless of format 36 CFR122034(i) Does the directive ensure RM participation in the development of electronic and other recordkeeping systems to ensure proper disposition Does the directive ensure that RM assists and advises agency officials regarding records disposition matters Does the directive evaluate the programrsquos results to ensure adequacy effectiveness and efficiency Does the directive cover the entire records management program Does the directive cover vital records (disaster planning and recovery business continuity) Does the directive cover information security Does the directive cover legal discovery Has the directive been disseminated throughout the agency and are the appropriate personnel aware of it 36 CFR 122034(d) Has agency implemented an internal records management training curriculum on an annual cycle or similar for all agency employees Does it include annual reminders of recordkeeping policies and practices 36 CFR 122034(f) Has the agency identified analyzed and assessed the risks to the integrity authenticity reliability usability and preservation of its records and information

(a) If yes Has the agency developed a risk mitigation plan Has the agency developed metrics to measure progress in risk mitigation 36 CFR

123610

Has the agency developed and implemented internal controls to ensure that all agency records are managed according to 36 CFR and NARA guidance 36 CFR 122226(e)

(a) If yes do the controls prevent unauthorized disposition ensure transfer of permanent records in all media to NARA prevent unauthorized access to records and prevent unauthorized alteration or modification of records 36 CFR 122034(i)

Page E-2

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 32: Department of the Treasury Internal Revenue Service

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Has the agency developed performance goals for its records management program (a) If yes do the goals pertain to volume or percentage of records transferred to NARA number of staff (employees and contractor) trained percentage of records inventoried or scheduled

(b) If yes has the agency developed performance measures or metrics to measure the overall progress towards reaching its goals Does the agency have a program of evaluationsinspectionsaudits conducted on an annual cycle or similar to ensure the records management program is efficient effective and compliant 36 CFR 122034(j) Following evaluationsinspectionsaudits is a written report prepared on the findings and recommendations and presented to senior management Are recommendations following evaluationsinspectionsaudits acted upon and are after-action plans put into effect and evaluated to ensure compliance Do agency personnel properly distinguish between records non-record materials and personal papers 36 CFR 122234(f) Does the agency maintain a record set of all directives documenting agency programs policies and procedures Has the agency issued guidance on the records status of working papersfiles and drafts 36 CFR 122220 Is the agency schedule reviewed annually 36 CFR 122410(c) Does the agency prohibit the removal of records by employees 36 CFR 122224(6) Does records management program staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control Who conducts these briefings 36 CFR 122224(6) Are exit briefings documented for purposes of accountability 36 CFR 122224(6) Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records 36 CFR 122224(6) Has the agency established and implemented standards and procedures for classifying indexing filing and retrieving records and have the standards and procedures been made available to all employees 36 CFR 122234(a) Is access to all records regardless of media limited to authorized personnel 36 CFR 122030(c)(1) Are permanent series of records identified and maintained separately from temporary records 36 CFR 122234 Has the agency specified file locations for records in all media and does it have procedures in place for ensuring that records are not maintained at unauthorized sites 36 CFR 122234(a)

Page E-3

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 33: Department of the Treasury Internal Revenue Service

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Are standardized reference service procedures in place to facilitate the locating charging out (removing from file for use) and refiling of all records Is there a quality control process in place for this procedure36 CFR 122234(d) Are these standardized reference service procedures available to all employees Specifically are employees responsible for classifying indexing filing retrieving and re-filing records familiar with the procedures 36 CFR 122234(e) Has the agency specifically designated officials responsible for the maintenance and disposition of electronic records Are these officials given adequate access to all IT systems and do they have an adequate role in the acquisition and implementation of systems 36 CFR 122234(c) Does the agency send records off-site for storage

(a) If so does the storage facility meet the standards specified in 36 CFR 1234

(b) Does the agency meet the requirements specified in 36 CFR 123414(d) and 123216 so that NARA-approved retention periods are implemented properly records documenting final disposition actions are created and maintained and adequate documentation is created for each individual records series before transferring records to a records storage facility If the agency is storing records at a facility that is not in compliance is the facility actively correcting deficiencies to bring it into compliance or does the agency have a plan for removing the records (Agencies must initiate removal of records within 6 months of the discovery of non-compliance and must complete the removal within 18 months of the discovery)

Has the agency conducted business analyses to identify the federal record material in its custody 36 CFR122512(a) Does the agency maintain an accurate current schedule for all agency records 36 CFR 122510 Is the schedule(s) approved by NARA If so when What is the disposition authority number(s) assigned by NARA 36 CFR 122512(i) Does the schedule cover records in all media and formats 36 CFR 122510 Is the schedule reviewed and updated if necessary on an annual basis 36 CFR 122410(c) Does the agency have a policy and procedure in place for keeping track of changes that may affect a records schedule between scheduled reviews CFR 122522 Has the agency identified a list of circumstances that may affect a schedule Do procedures clearly indicate what changes require NARA approval Are records inventories and file plans kept up to date Does the agency have any unscheduled records Is a schedule being developed for these records Are these records being retained until a schedule is developed 36 CFR 122510 Do procedures clearly explain how to make changes to the existing schedule including updating the SF 115 and who should be notified of changes that may affect the records schedule

Page E-4

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 34: Department of the Treasury Internal Revenue Service

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Determine whether the agency uses the General Records Schedule (GRS) for records covered by the GRS 36 CFR 122712

Do agency personnel have easy access to and are they familiar with the agencyrsquos records schedule Does agency guidance provide adequate standards and procedures for classifying indexing filing and retrieving records 36 CFR 122034(i) Has the above guidance been sufficiently disseminated 36 CFR 122410 Are standardized reference procedures in place to facilitate the locating retrieving and re-filing of records that have been retired If so is there a quality control process in place to ensure the correct files are retrieved and ensure that they are returned to the proper file 36 CFR 122234(d)(1) Has this standardized reference guidance been sufficiently disseminated Does the agency have procedures in place to ensure that permanent records are identified and filed separately from non-permanent records 36 CFR 122234 Does the agency have procedures in place to ensure that it captures the information necessary to keep track of its records inventory Does the agency have a list of the facilities at which the agency stores records as well as the amount of records (in cubic feet or number of boxes) stored at each Is records retention and disposition functionality incorporated into all of the agencyrsquos recordkeeping systems (paper and electronic) 36 CFR 122410(d) Is there a current list of personnel (liaisons file custodians line staff contractors program managers) responsible for the activities related to the disposition of records 36 CFR 122034(d) Has the agency developed and implemented an internal training curriculum that covers the roles and responsibilities of these records management staff with regards to disposition 36 CFR 122034(f) Are these personnel familiar with federal regulations and NARA guidance covering the transfer and disposal of records 36 CFR 122410(e) Are these personnel familiar with the instructions included within the agencyrsquos records schedules and the General Records Schedule 36 CFR 122410(e) Has the agency issued a handbook guidance or a directive that contains records disposition policies and procedures as well as the NARA-approved agency records schedule and the General Records Schedule Has the agency developed and implemented a training curriculum for all staff covering their responsibilities concerning the disposition of records under their immediate control 36 CFR122034(f) Do disposition instructions (contained in the agencyrsquos records schedule or issued separately) for electronic records require the transfer to the National Archives of permanent electronic records in formats acceptable to NARA as soon as they become inactive or otherwise provide for pre-accessioning

Page E-5

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 35: Department of the Treasury Internal Revenue Service

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the agency have disposition instructions for all non-record material 36 CFR 122216(b)(3)

How does the agency ensure that the records schedule is being applied properly and consistently For records that are eligible for destruction does the agency follow one of the approved methods of destruction in 36 CFR 122624 Does the records management staff conduct briefings for new employees including senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Does records management staff conduct exit briefings for departing employees and senior officials on the appropriate disposition of records under their immediate control If not who conducts these briefings Are exit briefings documented for purposes of accountability Are departing employees and senior officials required to obtain approval from records management program staff or other designated official(s) before removing personal papers and copies of records Has the agency assigned responsibility for the development and implementation of the agency-wide program to manage all records created received maintained used or stored on electronic media Has the agency integrated the management of electronic records with other agency records and information resources management programs Has this been effective in promoting the proper management of electronic records 36 CFR 12366(a) Has the agency incorporated electronic records management objectives responsibilities and authorities in pertinent agency directives and disseminated them throughout the agency Has this dissemination of information been effective 36 CFR 12366(a) Has the accomplishment of electronic records management objectives been incorporated into larger records and information resource management objectives 36 CFR 12366(a) Have electronic records management objectives and responsibilities been incorporated into performance plans as appropriate Does the agency have procedures or a protocol in place for ensuring that records management requirements including recordkeeping requirements and disposition are addressed before approving new electronic information systems or enhancements to existing systems 36 CFR 12366(b) Is adequate training on recordkeeping requirements and the distinction between record and non-record material provided to those who use electronic mail systems 36 CFR 12366(a) Is adequate training provided to those who use electronic information systems in the operation care and handling of the equipment and software in order to minimize lost or altered information 36 CFR 12366(b) Does the agency maintain up-to-date information about all electronic information systems that is adequate to

Page E-6

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 36: Department of the Treasury Internal Revenue Service

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

(a) specify all technical characteristics necessary for reading or processing records (b) identify all defined inputs and outputs of the system (c) define the contents of the files and the records (d) determine restrictions on access and use (e) understand the purpose(s) and function(s) of the system (f) describe update cycles or conditions and rules for adding changing or deleting

information in a system and (g) ensure the timely authorized disposition of the records 36 CFR 123626(b)

Does the agency maintain an inventory of electronic information systems their location applicable disposition authorities (or status as unscheduled) and media in which electronic records are maintained in order to facilitate the management and disposition of electronic records 36 CFR 122636(a) Does the agency conduct periodic reviews of electronic information systems to ensure that they conform to the agencyrsquos policies and procedures as required by 44 USC 3506 Does the agency implement a records security program that incorporates the following

(a) ensures that only authorized personnel have access to electronic records (b) provides for backup and recovery of records to protect against loss of information (c) ensures that appropriate agency personnel are trained to safeguard sensitive or classified electronic records (d) minimizes the risk of unauthorized alteration or erasure of records (e) ensures that electronic records security is included in computer systems security plans prepared pursuant to the Computer Security Act of 1987

Has the agency identified any foreseeable problems in the transfer of permanent electronic records that are currently being created If so is the agency taking steps to address the possible problem 36 CFR 123622(e) Has the agency developed policies and procedures for the use of shared drives that include permissions access controls and acceptable formats for filing records needed for long-term retention Does the guidance address identification of records non-records and personal materials 36 CFR 12366(a) Does the guidance address the location of the record copy Has the agency established naming conventions applicable at the folder sub-folder and file level Are naming conventions enforced 36 CFR 12366(a)

Are folders and sub-folders structured to associate any records with corresponding records schedules including cutoff and disposal instructions 36 CFR 12366(a) Are related files in all media linked by metadata file plans and other tools 36 CFR 123610(e) Has the agency established an audit trail for records and information filed on shared drives 36 CFR 123610(c) Has the agency assigned points of contact responsible for shared drive management Do they receive training

Page E-7

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 37: Department of the Treasury Internal Revenue Service

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Does the record management staff work with Information Technology staff to ensure the integrity of the shared drive Are employees trained in the use of the shared drive and their responsibilities Does the agency have policies and procedures in place to handle email records that have a retention period longer than 180 days 36 CFR 123622(c) Are email records covered by an approved disposition authority (ie scheduled) 36 CFR 12366(a) Does the agency instruct staff on how to manage email records and provide instructions for following retention and management requirements for email records 36 CFR 123622(a) Are attachments to electronic mail messages that are an integral part of the record preserved as part of the electronic mail record or linked to the electronic mail record with other related records 36 CFR 123622(a)(2) Does the agency ensure that email messages that are federal records are preserved in the appropriate agency recordkeeping system If so how What tests are performed to ensure records are captures and preserved 36 CFR 123622(d)(1) Are agency employees allowed to use personal email accounts If yes are federal records sent or received on personal email systems captured and managed in accordance with agency recordkeeping practices 36 CFR 123622(b) Do agency employees use more than one agency-administered email account If yes is the name of the individual employee linked to each account Do the agencyrsquos instructions include how to identify and preserve electronic mail messages and address

(a) the preservation of transmission data (name of sender addressee(s) and date transmission was sent) for the context of the message to be understood (b) when to request acknowledgement of receipt for inclusion with the mail message 36 CFR 123622 (a)(1)

Has your agency or any officecomponent unit within your agency adopted an email archiving application If yes are email records in the repository covered by an approved disposition authority (ie scheduled) 36 CFR 12366(b) If yes does the email repository have the appropriate security measures in place to prevent unauthorized access modification or deletion of records 36 CFR 123610(b) If yes are all email records in the repository retrievable and usable for as long as needed to conduct agency business 36 CFR 123610(d) If yes are attachments to email messages preserved as part of the email record or linked to the email record with other related records 36 CFR 123622(2) If yes is required metadata outlined in 36 CFR 123622 captured If yes are records maintained in accordance with 36 CFR 123622

Does the agency or any officecomponent unit within the agency currently have a fully functioning Electronic Records Management System (ERMS)Records Management

Page E-8

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 38: Department of the Treasury Internal Revenue Service

Appendix E

RECORDS MANAGEMENT COMPLIANCE GUIDANCE CHECKLISTS

Application (RMA) for maintaining and preserving electronic records If yes Are the records associated with an approved records schedule and disposition instruction Are the records protected from unauthorized access modification or deletion Are audit trails employed to track use of the records Are the appropriate rights established for users to access the records and facilitate the search and retrieval of records Are all records retrievable and usable as long as needed to conduct business and meet NARA-approved dispositions Can permanent records be identified and transferred to NARA based on approved records schedules Can temporary records be identified and deleted when eligible for disposal Can a records hold or freeze on disposition be applied when required Has the agency scheduled its electronic records 36 CFR 12366(a) Is the agency disposing of its electronic records according to NARA-approved records schedules 36 CFR 12366(a) How are records eligible for disposal identified in electronic systems 36 CFR 12366(a) Does the agency transfer permanent electronic records to NARA 36 CFR 12366(a) Does the agency have a metadata standard in use Has the agency conducted a formal risk assessment concerning the potential risks to the agencyrsquos records

Has the agency corrected any identified risks that require mitigation Has the agency identified all of its vital records in all program and administrative offices 36 CFR 122316 Does the agency maintain and keep current an inventory of all vital records and their locations Does the agency have vital records policies and procedures Are vital records requirements incorporated into the agency records management directive Have vital records strategies including the use of records formats that do not require specialized equipment or remote access and offsite storage of backups and duplicates been designed and implemented Are vital records strategies tested on a regular (at least annual) basis Are vital records requirements incorporated into the agencyrsquos continuity-of-operations (COOP) plan Is Records Management represented on the agencyrsquos COOP program team Are vital records included in regular testing of the agencyrsquos emergency management procedures Has all staff with vital records responsibilities received formal training in these duties

Page E-9

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 39: Department of the Treasury Internal Revenue Service

APPENDIX F ACRONYMS AND ABBREVIATIONS

ARM Area Records Manager

AWSS Agency Wide Support Services

CSIRC Cyber Security Incident Report Center

COTS Commercial-Off-the-Shelf Software

CFR Code of Federal Regulations

DM Document Management

ECC Enterprise Computing Center

EeRMT eRecords Management Team

EOPS Enterprise Operations

FMSS Facilities Management and Security Services

FRC Federal Records Center

GRS General Records Schedule

IRC Individual Resource Coordinator

IRM Internal Revenue Manual

IRS Internal Revenue Service

ISRP Integrated Submission and Remittance Processing

IT Information Technology

ITS Incident Tracking System

LTO Linear Tape-Open

MTB Martinsburg

NARA National Archives and Records Administration

NIST National Institute of Standards and Technology

OMB Office of Management and Budget

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 40: Department of the Treasury Internal Revenue Service

Appendix F

PGLD Privacy Government Liaison and Disclosure

PoCA Plan of Corrective Action

POD Post of Duties

PST Personal Storage Table

RCCMS Reporting Compliance Case Management System

RFI Request for Information

RGS Report Generation Software System

RIM Records and Information Management (Also acronym for the office within the IRS responsible for records management)

RM Records Management

RMSA Records Management Self-Assessment

SAO Senior Agency Official

SOI Statistics of Income

TDP Treasury Department Publication

US United States

USC United States Code

Page F-2

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 41: Department of the Treasury Internal Revenue Service

June 25 2015

MEMORANDUM FOR CHIEF RECORDS OFFICER FOR THE US GOVERNMENT NATIONAL ARCHIVES AND RECORDS ADMINISTRATION (NARA)

FROM Mary J Howard Director Privacy Governmental Liaison and Disclosure

SUBJECT NARA Inspection Report Draft Dated 06222015

Thank you for the opportunity to respond to the above referenced draft reporting the results of NARArsquos 2015 inspection of the IRS Records and Information Management program (RIM) The IRS is committed to managing all records of its operations in compliance with the Federal Records Act and related guidance for federal agencies Accordingly we welcome your findings and recommendations and will use them in conjunction with our internal program assessments to identify areas for improvement and plan corrective actions

As you know prior to the enactment of the legislation that mandated this inspection IRS initiated several studies of the RIM program to assess our ability to ensure proper retention and retrieval of electronic records These studies were prompted by a potential loss of email records that came to light in responding to recent Congressional and investigative inquiries We further initiated steps towards ensuring protection of the emails of senior officials and executives on network servers to prevent potential loss in the future

As you also know IRS has identified technological capabilities and requirements needed to support an efficient and effective electronic recordkeeping system Our biggest challenge in moving forward continues to be limited budget The IRS budget has undergone considerable shrinkage in recent years while demands for technology solutions across the Service have increased Should funding become available however we are poised to invest in improved electronic capabilities

The Enterprise Plan for Effective Records Management at IRS is a living document that continues to be updated as we identify opportunities for improvement and modify our

csmolovi
Typewritten Text
csmolovi
Typewritten Text
Appendix G
csmolovi
Typewritten Text
csmolovi
Typewritten Text

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 42: Department of the Treasury Internal Revenue Service

2 policies and practices accordingly NARArsquos guidance identification of best practices and ongoing collaboration will help us shape this plan and achieve our objectives Attached please find more detailed responses to the specific findings and recommendations included in the NARA inspection report under Appendix C Often oversight organizations find that including the IRS responses along with their report of findings promotes transparency to the report recipients and the public We hope you will consider including the attached IRS responses as you forward your report to Congress If you have any questions please contact me at (202) 317-6449 or a member of your staff may contact Celia Richardson Director Identity and Records Protection at (202) 317-6451 Attachment

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 43: Department of the Treasury Internal Revenue Service

IRS Responses to NARA Inspection Report Findings amp Recommendations

Finding 1 The IRSrsquos current email management practices and technologies do not secure

all record email against potential loss

Recommendation 11 IRS needs to manage all agency email in a manner that ensures

reliability authenticity integrity and usability of email records

Recommendation 12 The IRS should end its current practice of storing PST files on

staff hard drives and shared drives and migrate legacy email to a dedicated electronic

records management system where it can be more effectively managed according to

NARA regulations and policy and the IRSrsquos business needs

IRS Response

IRS is committed to the important goal of managing all email records on network servers in an

electronic recordkeeping system This is one of the highest priorities in our Enterprise Plan for

Effective Records Management Within the last year we have taken a number of steps to ensure

that critical email records are retained on network servers But we must note that budget

reductions over recent years coupled with increasing technology demands have affected our

progress

More specifically we improved the way Senior Officials and executives manage their email

records by implementing an auto-archiving process Record emails (PST files) once stored on

local hard drives are now configured to auto-archive to network server space This action is in

preparation for Capstone implementation and a future enterprise solution for all email accounts

that will fully address records management requirements of all federal agencies [OMBNARA

Managing Government Records Directive (M-12-18)] by the December 2016 deadline

Finding 2 Policies and procedures for notifying NARA of erroneous or unauthorized

disposal of records are not consistently followed

Recommendation 2 The IRS should work with NARA to develop internal procedures

and guidance to clearly define when and how records loss or potential records loss is

identified and mana ged within the agency particularly how and when such loss is

reported to IRS RIM Program staff and subsequently to NARA

IRS Response Response to Recommendation 2 combined with response to Recommendation 3

Finding 3 IRS data management procedures do not adequately engage RIM staff when

records may be in jeopardy

Recommendation 3 The IRS processes involving the potential loss of electronic data

should be revised to include notification and coordination with the RIM Program to

mitigate potential loss of records

Page 1

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 44: Department of the Treasury Internal Revenue Service

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response to Findings 2 amp 3 and their Respective Recommendations

We agree that these are important areas for improvement and have already begun clarifying the

role of the Records and Information Management Program (RIM) to address situations where

there is a loss or potential loss of records RIM has engaged with the Computer Security Incident

Response Center (CSIRC) and internal stakeholders We have begun to expand the role of

records management in processes related to the security andor recovery repair and replacement

of physical media RIM is also updating the separating employee clearance process to certify

records preservation in the disposition of portable media andor hard drives turned-in and

recycled as part of that process RIM has scheduled a July meeting with NARA to begin

developing clear guidance on reporting lost records and how best to leverage current agency

initiatives in support of overall improved data management procedures

IRS employees are provided with clear guidance on the need to report lost records to the agency

Records Officer but what constitutes a reportable loss of electronic records is not always clear

We look forward to working with NARA to improve understanding identify best practices

across government agencies and clarify our internal guidance

Finding 4 Lacking a dedicated electronic email management system the IRS is indefinitely

holding backup tapes of its email accounts and executive staff shared drives

Recommendation 4 The IRS needs to stop the unsustainable practice of retaining backup

tapes indefinitely implement compliant electronic email management and recycle

backup tapes according to regulation and best practices

IRS Response

IRS senior leaders instituted a temporary policy to prevent the recycling of back-up tapes to

ensure responsiveness to recent Congressional and investigative inquiries for email records

Although this practice significantly decreases the chance of lost email records we agree that it is

ultimately unsustainable

Implementation of an electronic recordkeeping system that can effectively retain search and

retrieve email records should eliminate all need to keep backup tapes beyond the agencyrsquos

approved six-month retention period for business resumptionsystem restoration needs We have

developed business requirements for such a system and are integrating them into needed

infrastructure updates as funding permits But limited budget resources continue to be a

challenge In the interim IRS will continue to assess legal audit and other business needs for

these tapes

Finding 5 The IRSrsquos granular organizationally-based records control schedules are

cumbersome to use in an increasingly digital environment

Recommendation 5 The IRS should explore options for consolidating its records

schedules into a functional style that is more conducive to electronic records

management

Page 2

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 45: Department of the Treasury Internal Revenue Service

IRS Responses to NARA Inspection Report Findings amp Recommendations

IRS Response

The IRS is making progress in these areas and will continue to make improvements going

forward Our latest improvements to program-related records control schedules include

consolidation of many disparate chapters into one comprehensive document and updating series

descriptions and disposition authorities to better reflect current recordkeeping practices The IRS

will also reduce the disposition authorities to a more manageable and practical number With the

near completion of other schedule updates IRS is better positioned to consider scheduling

options that allow for more flexibility and coverage by subject matter business functions and

work processes as opposed to the traditional series or electronic system approach This practice

will help ensure that any unscheduled paper records are scheduled by December 2016 and will

increase the adoption and compliance of all disposition authorities by paper and electronic

recordkeeping systems

Finding 6 The IRS has encrypted permanent records that NARA will be unable to take

without decryption

Recommendation 6 The IRS should modify its records management policies to include

procedures to decrypt permanent email before transfer to NARA

IRS Response

IRS employees are required to encrypt email containing sensitive information to protect privacy

Permanent IRS email records cannot be transferred to NARA for 15 years after creation At the

current time we have no emails ready for transfer to NARA However we agree to update the

Records Management Handbook and other poli cy documents as applicable to better address

permanent electronic records transfer requirements in accordance with 36 CFR sect1235 and

NARA guidance This will include the deactivation of passwords or other forms of file level

encryption that would impede access to record data This capability was included in the

requirements for an electronic re cordkeeping system as described above

Finding 7 The IRS RIM Program h as limited capacity to monitor the implementation of

records management policies in program offices across the country

Recommendation 7 The IRS should develop a plan to enhance evaluations of records

practices in IRS business units including units where records are electronically

maintained NARA would like to see the plan as well as evidence of its implementation

IRS Response

IRS agrees with the importance of monitoring the implementation of records management

policies in program offices across the country Accordingly we have an extensive network of

subject matter experts and a practice of initiating continuous improvement opportunities in this

area

Page 3

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 46: Department of the Treasury Internal Revenue Service

IRS Responses to NARA Inspection Report Findings amp Recommendations

At present we have over 3000 Information Resource Coordinators (IRCs) throughout all

business units The IRCs work closely with Area Records Managers (ARMs) to ensure

adherence to electronic and paper records management policies and procedures ARMs and

RIM HQ staff approved more than 1000 files plans and conducted 317 records management

training and outreach sessions to 16421 employees in the past two years The IRS has

developed a plan to enhance evaluations of records practices in IRS business units including

units where records are electronically maintained Our plans to restructure some positions and

integrate them more closely with the policy development analysts in our Headquarters office

will continue to strengthen these efforts

We look forward to continuing our discussion of these initiatives with NARA and to identifying

additional metrics that will demonstrate their impact

Finding 8 RM training is not mandatory for all IRS staff and contractors including Senior

Officials

Recommendation 8 IRS should develop and implement mandatory records management

training for all staff

IRS Response

The IRS is taking steps to address this for all employees in the next few months Records

management training is included in the FY15 Privacy Mandatory Briefing required for all staff

and contractors including Senior Officials Mandatory briefings are taken by IRS employees

each year in the summer Further a comprehensive records management course is being

developed as required training for all current employees and contractors and will be part of the

orientation curriculum for new employees and contractors By the end of fiscal year (FY)15 two

senior records analysts will have obtained the NARA Certificate of Federal Records

Management Training and two additional RIM employees will complete the requirements for

the NARA Certificate in FY16

Page 4

Page 47: Department of the Treasury Internal Revenue Service